Jun 07 2017
- last edited on
Jul 24 2020
I've been going around in circles with office 365 and azure support on security reports in azure a/d portal.
We currently subscribe to office 365 and have had a few users credentials become compromised. With some basic reporting and alerts it could have been spotted very early on. Through searching I found this support article: https://support.office.com/en-us/article/Reports-in-the-Office-365-Security-Compliance-Center-7acd33...
I followed the necessary steps to register for our FREE azure account. I then tried to view the free reports listed on this support page: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-view-access-usage-reports
None of them load any data. Azure support told me that we needed an a/d premium license to view these reports.
None of the MS support articles mention that anywhere. The only data we do have access to is going to an invidividual user and looking at their sign-ins. However, even that doesn't seem reliable. No matter what dates we select, it only loads one or two days of activity.
I'm hoping someone on this forum can help me understand what we should have access to. I believe we should have access to these reports, azure support can't figure out why they aren't working, so they are telling us we need to upgrade our subscription.
I've already submitted two tickets with office 365 and azure support about this with no resolution. Any help would be appreciated.
Jun 07 2017 10:54 AM
The Azure AD editions page (https://docs.microsoft.com/en-us/azure/active-directory/active-directory-editions) clearly mentions that only the 3 "basic" reports are available for Free/Basic/O365 SKUs. The second article you linked gives you the breakdown for each individual report. So just send the support guy to read the documentation :)
Now, it's not unusual to have the data in these reports be delayed for hours at a time, so give it another try later on. You can also enable the event collection for the SCC Audit logs, though I dont think this is necessary in order to collect/process Azure AD events.
@Nasos Kladakis might be able to help here...
Jun 07 2017 10:59 AM
Thanks. This has been ongoing for a few months now, so I don't think it's a delay in report data. I understand that only those 3 reports are free, but they've literally never shown any events / data - even though we had an account that was having login events from all over the world which showed in their specific user sign in event log.
I've given those articles to azure support (and many more) but they just keep telling me we need to upgrade our subscription and that those reports wouldn't show any office 365 events and that they only record azure activity (pretty sure that's not true at all).
I will look into the SCC settings you mentioned. Thank you.
Jun 14 2017 08:56 AM - edited Jun 14 2017 08:56 AM
Does anyone from Microsoft view these posts? Does anyone have any idea how I can reach out to to get an official response on this?
Jun 14 2017 09:47 AM - edited Jun 14 2017 09:48 AM
Hello Jim, yes we do see these posts, I`m sorry it`s taken you so long to get an answer. I`ll make sure one of our subject matter experts help you out here.