SOLVED

Non-Admin notifications and Inactive Users

%3CLINGO-SUB%20id%3D%22lingo-sub-272055%22%20slang%3D%22en-US%22%3ENon-Admin%20notifications%20and%20Inactive%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-272055%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20All%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20been%20using%20the%20pre-built%20in%20templates%20with%20CAS%20and%20I%20was%20wondering%20if%20it%20was%20possible%20to%20do%20the%20following%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3ESharePoint%20-%20We%20have%20our%20SharePoint%20pretty%20well%20secure%2C%20but%20wanted%20to%20know%20if%20there%20was%20a%20way%20to%20notify%20that%20owner%20of%20the%20site%20whether%20or%20not%20someone%20has%20unauthorized%20access%20outside%20of%20a%20specific%20security%20group.%26nbsp%3B%3C%2FLI%3E%3CLI%3EInactive%20Users%20-%20I%20read%20that%20there%20was%20a%20policy%20alert%20template%20already%20built%20in%20to%20notify%20admins%20if%20there%20is%20inactive%20users%20past%2060%20days%2C%20but%20cannot%20find%20that.%20Is%20there%20any%20easy%20way%20to%20create%20one%3F%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-272055%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-278087%22%20slang%3D%22en-US%22%3ERe%3A%20Non-Admin%20notifications%20and%20Inactive%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-278087%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20Dima.%20I%20will%20look%20into%20creating%20this%20manually%20for%20SP%20notification%20and%20will%20just%20have%20to%20do%20an%20audit%20every%20so%20often%20until%20they%20have%20a%20built-in%20alert.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-274429%22%20slang%3D%22en-US%22%3ERe%3A%20Non-Admin%20notifications%20and%20Inactive%20Users%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-274429%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20William%2C%3C%2FP%3E%0A%3CP%3E1.%20Its%20definitely%20possible%20-%20you%20can%20create%20an%20activity%20policy%20with%20a%20filter%20of%20User%20-%26gt%3B%20From%20Group%20-%26gt%3B%20Not%20equals%20a%20specific%20group%2C%20and%20choose%20to%20send%20the%20alert%20via%20email%20-%20providing%20the%20relevant%20email%20address.%3C%2FP%3E%0A%3CP%3E2.%20Its%20not%20possible%20with%20a%20policy%2C%20but%20you%20can%20do%20to%20the%20Users%20and%20Accounts%20page%20under%20investigation%20and%20filter%20for%20all%20users%20with%20a%20Last%20Seen%20date%20longer%20than%2060%20days%20ago.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ERegards%2C%3C%2FP%3E%0A%3CP%3EDima.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Hi All,

 

We have been using the pre-built in templates with CAS and I was wondering if it was possible to do the following:

 

  • SharePoint - We have our SharePoint pretty well secure, but wanted to know if there was a way to notify that owner of the site whether or not someone has unauthorized access outside of a specific security group. 
  • Inactive Users - I read that there was a policy alert template already built in to notify admins if there is inactive users past 60 days, but cannot find that. Is there any easy way to create one?

 

 

2 Replies
Best Response confirmed by William Goth (New Contributor)
Solution

Hi William,

1. Its definitely possible - you can create an activity policy with a filter of User -> From Group -> Not equals a specific group, and choose to send the alert via email - providing the relevant email address.

2. Its not possible with a policy, but you can do to the Users and Accounts page under investigation and filter for all users with a Last Seen date longer than 60 days ago.

 

Regards,

Dima.

Thanks Dima. I will look into creating this manually for SP notification and will just have to do an audit every so often until they have a built-in alert.