Forum Discussion
ryeurolink
Sep 15, 2020Copper Contributor
Alert if 365 account status is changed from Sign-in blocked to allowed
Hi community Has anyone found a way to alert admins when an account sign-in ability has been unblocked? Thank you for any assistance.
- Sep 19, 2020
Yes.
Forward your audit logs to Log Analytics Workspace, and create alerts for these events.
Here is a KQL example for enabled accounts:
AuditLogs| where OperationName == "Enable account"
JanBakkerOrphaned
Sep 19, 2020Steel Contributor
Yes.
Forward your audit logs to Log Analytics Workspace, and create alerts for these events.
Here is a KQL example for enabled accounts:
AuditLogs
| where OperationName == "Enable account"
ryeurolink
Sep 21, 2020Copper Contributor
JanBakkerOrphaned
Ah, brilliant, didn't think that Azure could do this without some sort of paid subscription.
I'll look into it, and thank you for your answer!
- JanBakkerOrphanedSep 21, 2020Steel Contributor
For Azure Monitor Log Analytics, you pay for data ingestion and data retention.
Depending on your amount of data, you will have to pay a few bucks per month, but the Free Tier will get you started for sure.
See: