Differentiate between failed and interrupted sign-in logs with Get-MgAuditLogSignIn

The sign-in logs exposed through Get-MgAuditLogSignIn don’t surface the same high‑level Status values (“Success”, “Failure”, “Interrupted”) that are shown in the Entra admin center. In PowerShell and Microsoft Graph, the only status information available is the status object on each sign‑in record, which contains:

• errorCode
• failureReason
• additionalDetails

From these fields, only errorCode cleanly distinguishes success vs. non‑success:

• status/errorCode = 0 → successful sign‑in
• status/errorCode ≠ 0 → sign‑in not successful (covers both what the portal labels as Failure and Interrupted)

The documentation and cmdlet reference for Get-MgAuditLogSignIn describe how to query sign‑ins (including filtering on status/errorCode) but do not define or expose any mapping between specific error codes and the portal’s “Failure” vs. “Interrupted” labels, nor any separate field that carries that classification.

Therefore, using Get-MgAuditLogSignIn alone, sign-ins can be programmatically separated into:

• Successful: status/errorCode = 0
• Unsuccessful (failed or interrupted): status/errorCode ≠ 0

but there is no supported way in the API or PowerShell to further distinguish Failure from Interrupted as shown in the Entra admin center.

References:

• Get-MgAuditLogSignIn
• Microsoft Graph PowerShell cmdlets for Microsoft Entra monitoring and health
• Learn about the sign-in log activity details