Forum Discussion
Solved
Alert if 365 account status is changed from Sign-in blocked to allowed
Hi community Has anyone found a way to alert admins when an account sign-in ability has been unblocked? Thank you for any assistance.
Yes.
Forward your audit logs to Log Analytics Workspace, and create alerts for these events.
Here is a KQL example for enabled accounts:
AuditLogs| where OperationName == "Enable account"
Yes.
Forward your audit logs to Log Analytics Workspace, and create alerts for these events.
Here is a KQL example for enabled accounts:
AuditLogs
| where OperationName == "Enable account"
JanBakkerOrphaned
Ah, brilliant, didn't think that Azure could do this without some sort of paid subscription.
I'll look into it, and thank you for your answer!
For Azure Monitor Log Analytics, you pay for data ingestion and data retention.
Depending on your amount of data, you will have to pay a few bucks per month, but the Free Tier will get you started for sure.
See: