UserAuthenticationMethod: Understanding M365 Sign-In Logs

This report decodes the Microsoft 365 UserAuthenticationMethod numeric bitfield into human-readable authentication methods (e.g., Password Hash Sync, Passkey device-bound, Windows Hello for Business, QR code variants), describes the methodology of correlating Microsoft 365 audit logs with Entra ID sign-in logs using correlation IDs, provides SOL query examples and an MFA flow illustration, highlights unmapped bits and limitations, and records an update adding the synced passkey (bit 26) observed in 2026.