Login Event Tracking from Identity Providers and Endpoints

Harmony can now track login events pulled directly from your connected identity providers and endpoint management tools. This gives you a unified view of user authentication activity across your environment without requiring any additional configuration beyond your existing integrations.

Harmony continuously polls supported integrations for sign-in data and normalises it into the same event stream as webhook-delivered events. This means there are no gaps in coverage regardless of how your tools deliver data - whether through webhooks or polling, all login activity lands in the same place.

How It Works

When you connect an identity provider or endpoint management tool to Harmony, the platform automatically begins polling that integration for sign-in events at regular intervals. Each event is normalised into a consistent format so you can correlate authentication activity across different tools and providers in one unified view.

This polling-based approach works alongside any webhook-delivered events you already receive, ensuring complete coverage even for integrations that do not support real-time push notifications.

Supported Integrations

Microsoft Entra ID

Harmony supports login event tracking from Microsoft Entra ID sign-in logs. Each event captured from Entra ID includes rich metadata across the following categories:

• User - identity and account details for the authenticating user
• Application - the application or service the user signed in to
• Device - device information associated with the sign-in attempt
• Location - geographic and network location data
• Risk - risk signals and assessments associated with the sign-in event

Additional identity providers and endpoint management tools will be added in future releases.

Viewing Login Events

Login events collected from identity providers and endpoint management tools appear in the same event stream as all other Harmony events. You do not need to switch between separate views or dashboards to see authentication activity - it is unified alongside the rest of your security event data.

Prerequisites

To track login events from a supported integration, you must have that integration already connected to Harmony. No additional configuration is required beyond the standard integration setup. If you have not yet connected your identity provider or endpoint management tool, refer to the relevant integration guide in the Integrations section.