According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Entra ID (Azure AD) documentation, sign-in logs are the primary source for diagnosing and troubleshooting authentication and access issues for Azure AD-integrated services, including Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security).
The sign-in logs record all user authentication attempts - successful and failed - along with critical details such as:
* User identity (User Principal Name)
* Application name (in this case, "Microsoft Cloud App Security" or "Microsoft Defender for Cloud Apps")
* IP address and device details
* Conditional Access policy outcomes
* Failure reasons (e.g., MFA requirement, denied by Conditional Access, invalid token, etc.) These logs can be accessed directly from the Microsoft Entra admin center # Monitoring # Sign-in logs.
They allow administrators to quickly identify why a user was unable to access a specific cloud service, without needing to configure or collect extra data sources.
Other log types do not fit this scenario:
* Audit logs record changes (e.g., policy updates, role assignments) but not authentication attempts.
* Provisioning logs track synchronization and provisioning events from connected applications.
* Log Analytics is a log aggregation workspace; it's not the first-line diagnostic tool and requires extra configuration.
Hence, to identify the cause of User1's access error with minimal administrative effort, the correct choice is sign-in logs.