Entra ID sign-in logs contain unique identifiers:
- Correlation ID: The correlation ID groups sign-ins from the same sign-in session. The value is based on parameters passed by a client, so Microsoft Entra ID can't guarantee its accuracy.
- Request ID: An identifier that corresponds to an issued token. If you're looking for sign-ins with a specific token, you need to extract the request ID from the token, first.
- Unique token identifier: A unique identifier for the token passed during the sign-in. This identifier is used to correlate the sign-in with the token request.
The unique token identifier is emitted as the uti claim in ID tokens and access tokens.
The unique token identifier is the Base64 URL encoded Request ID GUID bytes in mixed-endian format (based on Windows GUID byte layout).
You can convert between Request ID and unique token identifier using PowerShell:
$requestid=[guid]'12345678-90ab-cdef-1234-567890abcdef'
$uti='eFY0EquQ780SNFZ4kKvN7w'
write-host "UTI for Request ID ${requestid}:"
[buffers.text.base64url]::encodetostring($requestid.tobytearray())
write-host "Request ID for UTI ${uti}:"
[guid][buffers.text.base64url]::decodefromutf8([text.encoding]::utf8.getbytes($uti))Gives:
UTI for Request ID 12345678-90ab-cdef-1234-567890abcdef:
eFY0EquQ780SNFZ4kKvN7w
Request ID for UTI eFY0EquQ780SNFZ4kKvN7w:
12345678-90ab-cdef-1234-567890abcdef