Monitoring partner relationship activity

[ashmelburnian]

Hi everybody,

We need to authorise Office 365 tenant access to a partner so that they can implement a Dynamics-based system.

Relationship: Reseller

Admin roles: Global administrator, Helpdesk administrator

The fact that this partner needs global administrator access to the entire tenant is concerning.

From a security viewpoint, is there any way to monitor activity on the tenant by this partner? Maybe under Security & Compliance > Audit Log?

Thanks

Ash

[#2]

The unified audit log is your best bet here. You can also use PIM and grant an "eligible" GA role, so that every time they need to perform some admin action with said account, someone on your end has to approve the elevation request.

[#3]

Thanks for your help. I don't think the "eligible" GA role and PIM will work as the partner needs full admin access to the tenant ongoing to allow Dynamics to function.

In regards to the audit log, do you know how to specifically see logged activity by the partner?

[#4 · Accepted solution]

They are still performing those admin actions in the context of a user, so just search from events corresponding to said user.

[#5]

Is there any way to connect a partner connection directly to a specific global admin user account?

Note that if they access the tenant admin console they would be doing so via the MS Partner portal / not entering login details.

[#6]

Well they do provide credentials where accessing the partner portal, don't they?

[#7]

@Vasil Michev  That's true. Unfortunately we don't know the username the partner will use, only their domain.

The New-ProtectionAlert cmdlet may work for what I require, however I'm not sure if it can match any.user@partnerdomain.com. The cmdlet might be something like the following which I'll try to test tomorrow.

New-ProtectionAlert -Name "Partner Tenant Activity" -NotifyUser user@tenantdomain.com -ThreatType Activity - Filter "Activity.TargetUserOrGroupType -like 'partnerdomain.com'"

[#8]

Dear All, have you found a way for customers to monitor and alert partner activity on their (customers) tenant? FYI - @ashmelburnian @Vasil Michev 

[#9]

Feedback link :
https://feedbackportal.microsoft.com/feedback/idea/cceef87a-858e-ec11-a81b-0022484c51ef
Delegated administration privileges (DAP) FAQ
https://docs.microsoft.com/en-us/partner-center/dap-faq#:~:text=Delegated%20administration%20privile....