Forum Discussion
Monitoring partner relationship activity
They are still performing those admin actions in the context of a user, so just search from events corresponding to said user.
VasilMichev That's true. Unfortunately we don't know the username the partner will use, only their domain.
The https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance/new-protectionalert?view=exchange-ps cmdlet may work for what I require, however I'm not sure if it can match any.user@partnerdomain.com. The cmdlet might be something like the following which I'll try to test tomorrow.
New-ProtectionAlert -Name "Partner Tenant Activity" -NotifyUser user@tenantdomain.com -ThreatType Activity - Filter "Activity.TargetUserOrGroupType -like 'partnerdomain.com'"
Dear All, have you found a way for customers to monitor and alert partner activity on their (customers) tenant? FYI - ashmelburnian VasilMichev