Alert if 365 account status is changed from Sign-in blocked to allowed

%3CLINGO-SUB%20id%3D%22lingo-sub-1658106%22%20slang%3D%22en-US%22%3EAlert%20if%20365%20account%20status%20is%20changed%20from%20Sign-in%20blocked%20to%20allowed%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1658106%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20community%3C%2FP%3E%3CP%3EHas%20anyone%20found%20a%20way%20to%20alert%20admins%20when%20an%20account%20sign-in%20ability%20has%20been%20unblocked%3F%3C%2FP%3E%3CP%3EThank%20you%20for%20any%20assistance.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1658106%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Contributor

Hi community

Has anyone found a way to alert admins when an account sign-in ability has been unblocked?

Thank you for any assistance.

1 Reply

@ryeurolink 

 

Yes. 

Forward your audit logs to Log Analytics Workspace, and create alerts for these events.

 

Example: Monitor your Azure AD Break Glass Accounts with Azure Monitor – Daniel Chronlund Cloud Tech Blog (da... 

 

Here is a KQL example for enabled accounts: 

 

AuditLogs
where OperationName == "Enable account"