Entra : Verify Windows Authentication Method from Sign-In Logs

 If you are looking to verify how a user is logging into Windows then you can do this from Entra, if you locate the user and then look for the Sign-in Logs section:

This will show you all the sign-in logs as below:

Add a filter, then choose Application then enter "Windows Sign In" (without quotes) then click Apply:

This will then only filter for events that correlate to a Windows login event:

You can now open one of those events some of the events will not contain authentication data under the Authentication option like this:

Note : If you have a Federated domain then Authentication will always be blank, as the authentication is not done by Entra but by the Federated service.

If your name is not federated then one of those events (usually, the one roughly around your login time) will contain the correct Authentication information as below:

This is a reliable way to tracking the method used but the outcome, just a nice to know if you did not already.

Note : The logs are recorded in UTC - which can also be referred to as Zulu (Z) time, in this example, I am in the UK during summer time, this means we are in BST of +1 hour - therefore a login event at 11:12 AM - would show in the logs as 10:12 AM