Cloud Identity Access Dataset – Service Principal Sign-In Logs – Benign & Suspicious Samples – enUS

This synthetically generated dataset contains detailed Azure Active Directory (Azure AD) Service Principal Sign-In Logs, capturing both successful and failed authentication attempts from applications, services, and automation scripts. Each record includes rich telemetry such as timestamp, operation details, conditional access policy enforcement, result status, application/service identifiers, IP geolocation, and authentication method metadata. It covers a variety of sign-in scenarios—from OAuth2 client credentials and refresh tokens to interactive flows—enforced by diverse Conditional Access controls (e.g., MFA, device compliance, location restrictions, approved applications). The logs span multiple geographies and cloud workloads (e.g., Azure DevOps, Microsoft Graph, Azure Monitor, Azure Key Vault), providing insight into both normal operational activity and suspicious or policy-blocked events. Supports use cases such as cloud identity security analytics, SOC automation, enterprise-scale threat hunting, and AI-driven anomaly detection. Helps solve problems like detecting unauthorized access attempts, modeling anomalous authentication patterns, tuning conditional access policies, and accelerating incident investigations across hybrid and multi-cloud environments. Because it is synthetically generated to closely mirror real-world patterns while containing no sensitive data, it is highly valuable for customers training machine learning models for authentication risk scoring, behavioral baselining, or threat detection—without the compliance risks of using production logs.