I was performing an audit in Microsoft Purview,
I did a New Search (preview) and I selected a person to "monitor" who was granted access to heightened security. I was monitoring to see what they might be doing and or if they were making changes. I did the audit on the account and for the date as "current" as possible. I ran the search, and it didn't show me that they changed from modern authentication to legacy authentication.
I noticed it when they told me. The area is here:
https://xxxxxxxxx-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx#/accessControl/LegacyAuthen...
Is there a way to have the auditing check the admin centers for admin's performing work and changing things?
Thank you.
Matt
