How to build a multi-tenant Entra ID sign-in audit pipeline with PowerShell. Microsoft Entra audit logs are the fastest way to confirm account takeover attempts, risky sessions, and policy drift. However, they don't always scale efficiently in multi-tenant environments. In this video, we discuss how to build a Graph-powered PowerShell pipeline for repeatable collection, consistent filters, and durable evidence. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. Choose sources and define the schema. Know exactly what data you're collecting and how you'll use it. Prioritize sign-in logs for both users and service principals, and decide whether you also need directory audit for full context. Define a minimal, consistent column set, including timestamp, user UPN, app display name or app ID, client app used, IP and location, MFA result, status codes, and correlation ID. A clear plan makes detections easier and reports more reliable. Secure the app registration and permissions. Enable unattended multi-tenant collection safely with the following steps: Sign in to your Microsoft Entra admin center, then navigate to Entra ID, then App registrations, then select New registration. Set a name for your reporting app. Under supported account types, specify who can use the app. Finally, select Register. Once done, store credentials in a secure vault, rotate log access, and record tenant consent status. This gives you a hardened, auditable foundation for automated collection. Connect with Graph PowerShell. Next, connect Windows PowerShell to your Microsoft Entra ID tenant. To do so, you'll need to follow these steps. Download the Microsoft Graph PowerShell module. Run to set the PowerShell execution policy to Remote Signed. Run to install the Microsoft Graph PowerShell module. Finally, run Connect-Entra-Scopes User .Read .All and sign in with an administrator account when prompted. After connecting, authenticate against each tenant using your app registration. Run baseline queries for a 24 to 72-hour window and validate key fields before exporting your data. Build high-signal filters and detections. The next step is to turn your raw logs into actionable security signals. To do that, you can create saved filters for legacy authentication, repeated MFA failures, unfamiliar locations or autonomous system numbers, ASNs, high-risk sign-ins, and unusual client apps. Add enrichment like geo, ASN, and user department, along with per-tenant allow lists to reduce noise. Set thresholds and severities that map directly to playbooks such as investigate, notify the appropriate team, or raise an incident. Schedule, store, and report at scale. Schedule hourly or daily polls with backfill logic to avoid gaps. Write per-tenant exports to structured folders with versioning and retention. Generate daily and monthly roll-ups with detection counts and trend deltas. Create alert routes for critical detections. Then publish monthly sign-in security scorecards per tenant covering legacy auth rate, MFA failure rate, risky sign-ins, and MTTR. Track remediation tasks and confirm improvement in the next roll-up. A Graph-powered, PowerShell-driven pipeline turns Entra sign-in logs into a powerful operational asset with repeatable collection, dependable detections, and audit-ready evidence. For more information, check out our official blog post on how to build a multi-tenant Entra ID sign-in audit pipeline with PowerShell, linked in the description below.