Entra ID user auditing

As an administrator, sometimes it's hard to know which organizational aspects you need to keep track of and which are trivial. Odds are, there's been a few times when you've asked yourself "How did we miss that?!". But it's not always possible to know everything that is happening within your organization as user activities are often sporadic.

Auditing Entra ID users with M365 Manager Plus

M365 Manager Plus' predefined audit reports are highly detailed, allowing you to track everything going on in your Microsoft 365 environment. It audits each and every user activity in your Microsoft 365 environment and presents the audit logs in the form of reports for quick understanding. With advanced attribute-based filters, you can zero in on specific details to view the data you need to see.

M365 Manager Plus provides Microsoft 365 user audit reports under the following categories:

• User accounts
• User logon activities
• Password-related activities
• Azure administrator activities
• Administrative actions by delegated users

Entra ID user accounts

A lot of employees may enter and leave your organization at any point in time. It's important to keep track of every new user account being created and deleted in your Azure AD environment. To meet this need, M365 Manager Plus provides:

• User Created Report: Gives audit details on all the user accounts created in a specific period of time.
• User Deleted Report: Gives audit details on all the user accounts deleted in a specific period of time.
• User Modified Report: Lists modified user accounts with audit details on the modification.

Azure AD user logon activities

Monitoring Microsoft 365 user login behavior can help you identify unauthorized logons by intruders. For example, multiple failed logon attempts may point to an unauthorized user trying to gain access to an account. M365 Manager Plus lets you audit every recent successful and failed logons with details on the exact time of occurrence and location.

Password-related activities

Passwords are the point of entry for any valuable resource inside your organization. As an administrator, monitoring password changes is crucial as it helps detect unusual activity and prevent unauthorized access. With M365 Manager Plus, you can view audit reports on the following user actions:

• Reset user password: Know about the password resets made in your user accounts to make sure that they are made by authorized personnel.
• Changed user password: Keep track of Microsoft 365 user password changes to make sure that users change their account passwords regularly for security purposes.
• Set user property that forces user to change password: Know about the users who had been forced to change their passwords, and by whom.

You can also get details on Microsoft 365 users whose passwords have expired, users whose passwords are about to expire, users' multi-factor authentication status, and more with Azure AD audit reports.

Azure administrator activities

In large organizations that perform business operations worldwide, it's common practice to have multiple administrators in one domain or region. To avoid chaos, it's necessary to monitor admin activities. Monitoring admin activities is also mandatory to meet several compliance requirements.

M365 Manager Plus' Azure AD Admin Activities Report helps you find out who did what operation and when. This report also provides details on the target object and the status of the operation.

Benefits of using M365 Manager Plus:

• Export reports to PDF, HTML, CSV, or HTML formats.
• Schedule reports to be generated at periodic intervals and have them emailed to you.
• Save filtered details from one report as a new report.
• Create your own report profiles and views to avoid perusing the entire list of reports to find what you need.
• Get real-time alerts based on audits to prevent security breaches.