Sep 11 2020 09:13 AM
Hi community
Has anyone found a way to alert admins when an account sign-in ability has been unblocked?
Thank you for any assistance.
Sep 19 2020 03:26 AM
@ryeurolink
Yes.
Forward your audit logs to Log Analytics Workspace, and create alerts for these events.
Example: Monitor your Azure AD Break Glass Accounts with Azure Monitor – Daniel Chronlund Cloud Tech Blog (da...
Here is a KQL example for enabled accounts:
