Azure Active Directory user auditing

As an administrator, sometimes it's hard to know which organizational aspects you need to keep track of and which are trivial. Odds are there's been a few times when you've asked yourself "How did we miss that?!". But it's not always possible to know everything that is happening within your organization, as user activities are often sporadic.

Microsoft 365 user auditing with M365 Security Plus

M365 Security Plus' predefined audit reports are highly detailed, allowing you to track everything going on in your Microsoft 365 environment. It audits each and every user activity in your Microsoft 365 environment and presents the audit logs in the form of reports for quick understanding. With advanced attribute-based filters, you can zero in on specific details to view the data you need to see.

M365 Security Plus provides Microsoft 365 user audit reports under the following categories:

• User accounts
• User logon activities
• Password-related activities
• Azure administrator activities
• Administrative actions by delegated users

Azure AD user accounts

A lot of employees may enter and leave your organization at any point in time. It's important to keep track of every new user account being created and deleted in your Azure AD environment. To meet this need, M365 Security Plus provides:

• User Created Report: Gives audit details on all the user accounts created in a specific period of time.
• User Deleted Report: Gives audit details on all the user accounts deleted in a specific period of time.
• User Modified Report: Lists modified user accounts with audit details on the modification.

Azure AD user logon activities

Monitoring Microsoft 365 user login behavior can help you identify unauthorized logons by intruders. For example, multiple failed logon attempts may point to an unauthorized user trying to gain access to an account.

With M365 Security Plus, you can audit:

• Logons using passwords
• Logons using cookies
• Recent logon failures
• Recent successful logons

Password-related activities

Passwords are the point of entry for any valuable resource inside your organization. As an administrator, you must ensure that users change their passwords periodically to ensure their accounts won't be compromised. With M365 Security Plus, you can view audit reports on the following user actions:

• Reset user password: Know about the password resets made in your Office user accounts, to make sure that they are made by authorized personnels.
• Changed user password: Keep track of Microsoft 365 user password changes to make sure that users change their account passwords regularly for security purposes.
• Set user property that forces user to change password: Know about the users who had been forced to change their passwords, and by whom.

You can also get details on Microsoft 365 users whose passwords have expired, users whose passwords are about to expire, users' multi-factor authentication status, and more with Azure AD audit reports.

Azure administrator activities

In large organizations that perform business operations worldwide, it's common practice to have multiple administrators in one domain or region. To avoid chaos, it's necessary to monitor admin activities. Monitoring admin activities is also mandatory to meet several compliance requirements.

M365 Security Plus' Azure AD Admin Activities Report helps you find out who did what operation and when. This report also provides details on the target object and the status of the operation.

Benefits of using M365 Security Plus:

• Export reports to PDF, HTML, CSV, or HTML formats.
• Schedule reports to be generated at periodic intervals and have them emailed to you.
• Save filtered details from one report as a new report.
• Create your own report profiles and views to avoid perusing the entire list of reports to find what you need.
• Get real-time alerts based on audits to prevent security breaches.