Forum Discussion

David Levine's avatar
David Levine
Brass Contributor
Feb 15, 2017

Office365 Audit Log Information

Hi all,

So, I was pulled into a session with counsel and a foresics persion today to discuss some stuff. I came away windering if there was an easy way to "show me every time that <user> logged in to an Office365 service, where the login originated (ip address?), and form what type of device (domain joined?)"...

 

I see an event like "PasswordLogonInitialAuthUsingPassword" which shows some basic info, including the client IP address, but I don't see anything about the client device itself. Is there anything like this available today or is there anything being considered for future implementation?

 

Thanks!

Resources