SOLVED

Alert for New Added User

%3CLINGO-SUB%20id%3D%22lingo-sub-2650614%22%20slang%3D%22en-US%22%3EAlert%20for%20New%20Added%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2650614%22%20slang%3D%22en-US%22%3E%3CP%3EI%20can't%20find%20any%20resources%2Fguide%20to%20create%2Fenable%2Fturn-on%20an%20alert%20for%20newly%20added%20users.%20Is%20there%20such%20a%20thing%20in%20Office%20365%20admin%20center%3F.%20I%20want%20to%20monitor%20newly%20added%20user%20on%20my%20domain%2C%20and%20review%20it%20if%20it's%20valid%20or%20not.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2650614%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2651027%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20for%20New%20Added%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2651027%22%20slang%3D%22en-US%22%3EThere%20are%20no%20%22out%20of%20the%20box%22%20alerts%20around%20new%20user%20creation%20unfortunately.%20What%20you%20could%20do%20is%20leverage%20the%20Graph%20API%20and%20subscriptions%20to%20monitor%20user%20changes%2C%20or%20alternatively%20you%20can%20use%20the%20audit%20log%20to%20search%20for%20any%20activities%20for%20new%20user%20creation%20during%20a%20specific%20period.%20The%20latter%20would%20be%20a%20manual%20action%2C%20and%20the%20first%20would%20be%20complex%20to%20do%20unfortunately.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2651276%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20for%20New%20Added%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2651276%22%20slang%3D%22en-US%22%3EThanks%20for%20your%20reply%2C%20I%20will%20be%20going%20with%20the%20manual%20action%20for%20now%20as%20I'm%20still%20new%20with%20the%20admin%20center.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2651290%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20for%20New%20Added%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2651290%22%20slang%3D%22en-US%22%3EHello%2C%20you%20can%20use%20the%20%22legacy%22%20activity%20alerts%20%3CA%20href%3D%22https%3A%2F%2Fcompliance.microsoft.com%2Fmanagealerts%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcompliance.microsoft.com%2Fmanagealerts%3C%2FA%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2651291%22%20slang%3D%22en-US%22%3ERe%3A%20Alert%20for%20New%20Added%20User%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2651291%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F1126442%22%20target%3D%22_blank%22%3E%40Happyter%3C%2FA%3E%26nbsp%3BOnce%20you%20feel%20more%20comfortable%20with%20this%2C%20a%26nbsp%3Bsimpler%20script%20and%20Graph%20API%20approach%20could%20be%20to%20use%20the%20Graph%20PowerShell%20module%2C%20the%20%3CEM%3EcreatedDateTime%3C%2FEM%3E%20attribute%20of%20the%20%3CEM%3Euser%3C%2FEM%3E%20resource.%20This%20way%20you%20could%20script%20this%2C%20run%20the%20script%20in%20scheduled%20manner%20and%20get%20some%20kind%20of%20output.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHave%20a%20look%20at%20the%20Get-MgUser%20cmdlet.%20If%20you%20run%20it%20like%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-powershell%22%3E%3CCODE%3E%24Date%20%3D%20(Get-Date).ToUniversalTime().AddMinutes(-15).ToString(%22yyyy-MM-ddTHH%3Amm%3AssZ%22)%0A%24NewUsers%20%3D%20Get-MgUser%20-Filter%20%22createdDateTime%20ge%20%24Date%22%20-ConsistencyLevel%20eventual%20-CountVariable%20ResultCount%0Aif%20(%24ResultCount%20-gt%200)%20%7B%0A%20%24NewUsers%0A%7D%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWould%20return%20a%20list%20of%20all%20users%20created%20in%20the%20past%2015%20minutes.%20You%20could%20extend%20this%20to%20take%20some%20action%20like%20send%20an%20email%2C%20and%20schedule%20the%20script%20to%20run%20regularly.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I can't find any resources/guide to create/enable/turn-on an alert for newly added users. Is there such a thing in Office 365 admin center?. I want to monitor newly added user on my domain, and review it if it's valid or not.

9 Replies
There are no "out of the box" alerts around new user creation unfortunately. What you could do is leverage the Graph API and subscriptions to monitor user changes, or alternatively you can use the audit log to search for any activities for new user creation during a specific period. The latter would be a manual action, and the first would be complex to do unfortunately.
Thanks for your reply, I will be going with the manual action for now as I'm still new with the admin center.
best response confirmed by Happyter (Occasional Contributor)
Solution
Hello, you can use the "legacy" activity alerts https://compliance.microsoft.com/managealerts

@Happyter Once you feel more comfortable with this, a simpler script and Graph API approach could be to use the Graph PowerShell module, the createdDateTime attribute of the user resource. This way you could script this, run the script in scheduled manner and get some kind of output.

 

Have a look at the Get-MgUser cmdlet. If you run it like:

 

$Date = (Get-Date).ToUniversalTime().AddMinutes(-15).ToString("yyyy-MM-ddTHH:mm:ssZ")
$NewUsers = Get-MgUser -Filter "createdDateTime ge $Date" -ConsistencyLevel eventual -CountVariable ResultCount
if ($ResultCount -gt 0) {
	$NewUsers
}

 

Would return a list of all users created in the past 15 minutes. You could extend this to take some action like send an email, and schedule the script to run regularly.

Forgot about that page! Why on earth they removed the activity for "Added user" on the new policy page is beyond me :( Let's hope this is still "work in progress" and it'll re-appear someday :)

Yeah the portals and all the moving around is quite a mess really :) I'm pretty sure there's work in progress though.

@ChristianJBergstrom Thank you for your reply, I've proceed and created the rule, hope it works well.

Let me know if it fits your business needs and if so please "mark as best response" to close the conversation. Thanks.