Microsoft Entra ID

How to analyze the Microsoft Entra provisioning logs

5 August 2026Updated+69 / −3 lines

In brief

The article now explains viewing and downloading provisioning logs through the admin center, Microsoft Graph, and Microsoft MCP Server for Enterprise. The MCP integration supports natural-language, read-only analysis through delegated permissions and is currently limited to the global service.

What Entra admins need to know

To use it, administrators must provision the MCP server, configure an MCP client, grant MCP.ProvisioningLog.Read.All, and sign in with a supported Entra role; Reports Reader is the least privileged listed role. It supports no write operations, application-only access, or expanded permissions, and remains subject to log retention, Graph throttling, and MCP limits.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: How to analyze the Microsoft Entra provisioning logs description: Learn how to view, download, ~~view,~~ and analyze ~~the details in the~~Microsoft Entra provisioning logs ~~from~~by using the admin center, Microsoft ~~Entra ID.~~Graph, and Microsoft MCP Server for Enterprise. ms.topic: how-to ms.date: ~~07/10/2025~~08/03/2026 ms.reviewer: arvinh ms.custom: sfi-image-nochange

Customer intent: As an IT admin, I want to download, view, and analyze the details in the provisioning logs from Microsoft Entra ID.

The Microsoft Entra provisioning logs provide details about the provisioning events that occur in your tenant. You can use the information captured in the provisioning logs to help troubleshoot issues with a provisioned user.

This article describes ~~the options for downloading~~how to view and download the provisioning ~~logs from the Microsoft Entra admin center and how to~~logs, analyze the ~~logs. Error codes~~logs by using Microsoft Graph or Microsoft MCP Server for Enterprise, and ~~special considerations are also included.~~troubleshoot common errors.

Prerequisites

Stream logs to Azure Monitor through diagnostic settings.
Analyze logs through Workbook templates.
Access logs programmatically through the Microsoft Graph API.
Ask natural-language questions about the logs by using Microsoft MCP Server for Enterprise.
Download the logs as a CSV or JSON file.

To access the logs in the Microsoft Entra admin center:

Some error codes contain AzureActiveDirectory in the name. These error codes refer to Microsoft Entra ID, but could not be rebranded from Azure Active Directory.

Error codesAnalyze provisioning logs with Microsoft MCP Server for Enterprise (Preview)

~~Use~~Microsoft MCP Server for Enterprise lets you use natural-language prompts to analyze provisioning logs in an MCP-enabled AI client. The server translates a prompt into a read-only Microsoft Graph request, runs the ~~following table~~request with your delegated permissions, and summarizes the response.

Prerequisites

In addition to ~~better understand how~~the prerequisites for this article:

An administrator must provision Microsoft MCP Server for Enterprise and configure an MCP client.
The MCP client must be granted the MCP.ProvisioningLog.Read.All delegated permission.
You must sign in to ~~resolve errors~~the MCP client with a work or school account that has a supported Microsoft Entra role. Reports Reader is the least privileged supported role.

Microsoft MCP Server for Enterprise supports delegated, user-interactive access only. It doesn't support application-only access.

Ask questions about provisioning activity

Open your configured MCP client, select its agent mode if required, and ask a specific question about the provisioning activity that you ~~find in~~want to investigate. For example:

Scenario	Example prompt
Review recent failures	`Show me recent provisioning errors.`
Review a user's history	`Show recent provisioning events for the user with ID <user-id>.`
Review successful creates	`Show me recent successful provisioning create operations.`
Review successful deletes	`Were any users successfully deleted by the provisioning logs.service?`
Review successful disables	`Were any users successfully disabled by the provisioning service?`

Use an object ID instead of a display name when possible. You can also include a time range, application name, status, or provisioning action to make the request more specific.

~~Check the status of user provisioning~~
The AI agent can use the MCP server's query-suggestion tool to select an appropriate Microsoft Graph request and then run the request with the read-only Microsoft Graph tool. For example, the prompt Show me recent provisioning errors can result in this request:
```
GET https://graph.microsoft.com/v1.0/auditLogs/provisioning?$filter=provisioningStatusInfo/status eq 'failure'&$orderby=activityDateTime desc&$top=5
```
The prompt Show recent provisioning events for the user with ID <user-id> can result in this request:
```
GET https://graph.microsoft.com/v1.0/auditLogs/provisioning?$filter=sourceIdentity/id eq '<user-id>'&$orderby=activityDateTime desc&$top=5
```
The provisioning logs API supports $filter, $orderby, $top, and $skiptoken. Filters are case-sensitive. For supported properties and query behavior, see List provisioningObjectSummary.
Tip
Review the Microsoft Graph request shown by the AI agent before relying on its summary. Confirm that filters, object IDs, status values, actions, and time ranges match your investigation. Ask a follow-up question if you need more records or details from provisioningSteps, modifiedProperties, or provisioningStatusInfo.
What you should know
- The MCP server can't restart a job, provision an object, or change a provisioning configuration. Use the Microsoft Entra admin center, Microsoft Graph, or PowerShell for write operations.
- Microsoft MCP Server for Enterprise queries the same Microsoft Graph provisioning log data and is subject to the same provisioning log retention period.
- MCP requests are subject to Microsoft Graph throttling and the MCP server limits.
- The MCP server honors the signed-in user's role and the delegated scopes granted to the MCP client. It doesn't expand the user's access to provisioning data.
- Natural-language responses are generated summaries. For investigations and support cases, verify the underlying Microsoft Graph request and use identifiers such as changeId, jobId, and object IDs from the response.
Error codes

Use the following table to better understand how to resolve errors that you find in the provisioning logs.

@@ -1,8 +1,8 @@ --- title: How to analyze the Microsoft Entra provisioning logs-description: Learn how to download, view, and analyze the details in the provisioning logs from Microsoft Entra ID.+description: Learn how to view, download, and analyze Microsoft Entra provisioning logs by using the admin center, Microsoft Graph, and Microsoft MCP Server for Enterprise. ms.topic: how-to-ms.date: 07/10/2025+ms.date: 08/03/2026 ms.reviewer: arvinh ms.custom: sfi-image-nochange # Customer intent: As an IT admin, I want to download, view, and analyze the details in the provisioning logs from Microsoft Entra ID.@@ -12,7 +12,7 @@ ms.custom: sfi-image-nochange  The Microsoft Entra provisioning logs provide details about the provisioning events that occur in your tenant. You can use the information captured in the provisioning logs to help troubleshoot issues with a provisioned user. -This article describes the options for downloading the provisioning logs from the Microsoft Entra admin center and how to analyze the logs. Error codes and special considerations are also included.+This article describes how to view and download the provisioning logs, analyze the logs by using Microsoft Graph or Microsoft MCP Server for Enterprise, and troubleshoot common errors.  ## Prerequisites @@ -29,6 +29,7 @@ There are several ways to view or analyze the Provisioning logs: - Stream logs to [Azure Monitor](../app-provisioning/application-provisioning-log-analytics.md) through diagnostic settings. - Analyze logs through [Workbook](howto-use-workbooks.md) templates. - Access logs programmatically through the [Microsoft Graph API](/graph/api/resources/provisioningobjectsummary).+- Ask natural-language questions about the logs by using [Microsoft MCP Server for Enterprise](/graph/mcp-server/overview). - [Download the logs](howto-download-logs.md) as a CSV or JSON file.  To access the logs in the Microsoft Entra admin center:@@ -105,6 +106,67 @@ Here are some tips and considerations for analyzing the provisioning logs:  - Some error codes contain `AzureActiveDirectory` in the name. These error codes refer to Microsoft Entra ID, but could not be rebranded from Azure Active Directory. +## Analyze provisioning logs with Microsoft MCP Server for Enterprise (Preview)++Microsoft MCP Server for Enterprise lets you use natural-language prompts to analyze provisioning logs in an MCP-enabled AI client. The server translates a prompt into a read-only Microsoft Graph request, runs the request with your delegated permissions, and summarizes the response.++> [!IMPORTANT]+> Microsoft MCP Server for Enterprise is in preview. It's currently available only in the global service and supports read-only operations. Review [Overview of Microsoft MCP Server for Enterprise](/graph/mcp-server/overview) for current availability and limitations.++### Prerequisites++In addition to the prerequisites for this article:++- An administrator must [provision Microsoft MCP Server for Enterprise and configure an MCP client](/graph/mcp-server/get-started).+- The MCP client must be granted the `MCP.ProvisioningLog.Read.All` delegated permission.+- You must sign in to the MCP client with a work or school account that has a supported Microsoft Entra role. Reports Reader is the least privileged supported role.++Microsoft MCP Server for Enterprise supports delegated, user-interactive access only. It doesn't support application-only access.++### Ask questions about provisioning activity++Open your configured MCP client, select its agent mode if required, and ask a specific question about the provisioning activity that you want to investigate. For example:++| Scenario | Example prompt |+| --- | --- |+| Review recent failures | `Show me recent provisioning errors.` |+| Review a user's history | `Show recent provisioning events for the user with ID <user-id>.` |+| Review successful creates | `Show me recent successful provisioning create operations.` |+| Review successful deletes | `Were any users successfully deleted by the provisioning service?` |+| Review successful disables | `Were any users successfully disabled by the provisioning service?` |++Use an object ID instead of a display name when possible. You can also include a time range, application name, status, or provisioning action to make the request more specific.++The AI agent can use the MCP server's query-suggestion tool to select an appropriate Microsoft Graph request and then run the request with the read-only Microsoft Graph tool. For example, the prompt `Show me recent provisioning errors` can result in this request:++```http+GET https://graph.microsoft.com/v1.0/auditLogs/provisioning?$filter=provisioningStatusInfo/status eq 'failure'&$orderby=activityDateTime desc&$top=5+```++The prompt `Show recent provisioning events for the user with ID <user-id>` can result in this request:++```http+GET https://graph.microsoft.com/v1.0/auditLogs/provisioning?$filter=sourceIdentity/id eq '<user-id>'&$orderby=activityDateTime desc&$top=5+```++The provisioning logs API supports `$filter`, `$orderby`, `$top`, and `$skiptoken`. Filters are case-sensitive. For supported properties and query behavior, see [List provisioningObjectSummary](/graph/api/provisioningobjectsummary-list).++> [!TIP]+> Review the Microsoft Graph request shown by the AI agent before relying on its summary. Confirm that filters, object IDs, status values, actions, and time ranges match your investigation. Ask a follow-up question if you need more records or details from `provisioningSteps`, `modifiedProperties`, or `provisioningStatusInfo`.++### What you should know++- The MCP server can't restart a job, provision an object, or change a provisioning configuration. Use the Microsoft Entra admin center, Microsoft Graph, or PowerShell for write operations.++- Microsoft MCP Server for Enterprise queries the same Microsoft Graph provisioning log data and is subject to the same provisioning log retention period.++- MCP requests are subject to Microsoft Graph throttling and the MCP server limits.++- The MCP server honors the signed-in user's role and the delegated scopes granted to the MCP client. It doesn't expand the user's access to provisioning data.++- Natural-language responses are generated summaries. For investigations and support cases, verify the underlying Microsoft Graph request and use identifiers such as `changeId`, `jobId`, and object IDs from the response.++ ## Error codes  Use the following table to better understand how to resolve errors that you find in the provisioning logs.@@ -158,3 +220,7 @@ Use the following table to better understand how to resolve errors that you find - [Check the status of user provisioning](../app-provisioning/application-provisioning-when-will-provisioning-finish-specific-user.md) - [Problem configuring user provisioning to a Microsoft Entra Gallery application](../app-provisioning/troubleshoot.md) - [Graph API for provisioning logs](/graph/api/resources/provisioningobjectsummary)+- [Overview of Microsoft MCP Server for Enterprise](/graph/mcp-server/overview)+- [Get started with Microsoft MCP Server for Enterprise](/graph/mcp-server/get-started)+- [Sample prompts for Microsoft MCP Server for Enterprise](/graph/mcp-server/mcp-server-sample-prompts)+- [List provisioningObjectSummary](/graph/api/provisioningobjectsummary-list)