SOLVED

Alerting if new Global Admin is added to tenant?

%3CLINGO-SUB%20id%3D%22lingo-sub-827778%22%20slang%3D%22en-US%22%3EAlerting%20if%20new%20Global%20Admin%20is%20added%20to%20tenant%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-827778%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20it%20possible%20to%20set%20an%20alert%20on%20changes%20to%20the%20Global%20Admin%20role%20membership%3F%20Any%20direction%20would%20be%20most%20appreciated.%3C%2FP%3E%3CP%3ETHX.%20Eric%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-827778%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-828276%22%20slang%3D%22en-US%22%3ERe%3A%20Alerting%20if%20new%20Global%20Admin%20is%20added%20to%20tenant%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-828276%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F212728%22%20target%3D%22_blank%22%3E%40E%20Wuichner%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20go%20to%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fprotection.office.com%2Funifiedauditlog%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fprotection.office.com%2Funifiedauditlog%3C%2FA%3E%26nbsp%3Band%20then%20click%20the%20new%20alert%20button%2C%20change%20the%20alert%20type%20from%20Custom%20to%20Elevation%20of%20Privileges%2C%20give%20the%20alert%20a%20name%2C%20description%20and%20then%20an%20email%20address%20for%20the%20alert%20to%20go%20to%20and%20then%20press%20save.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHope%20that%20helps%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIain.%3CBR%20%2F%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F129012iEF7EB90B05E256D6%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20alt%3D%22clipboard_image_2.png%22%20title%3D%22clipboard_image_2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-828599%22%20slang%3D%22en-US%22%3ERe%3A%20Alerting%20if%20new%20Global%20Admin%20is%20added%20to%20tenant%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-828599%22%20slang%3D%22en-US%22%3E%3CP%3EYou%20should%20actually%20have%20a%20built-in%20alert%20for%20that%20under%26nbsp%3B%3CFONT%20style%3D%22background-color%3A%20%23ffffff%3B%22%3E%3CA%20href%3D%22https%3A%2F%2Fprotection.office.com%2Falertpolicies%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fprotection.office.com%2Falertpolicies%3C%2FA%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EAnd%20the%20Azure%20AD%20Privileged%20Identity%20Management%20feature%20should%20also%20be%20mentioned%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fprivileged-identity-management%2Fpim-configure%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fprivileged-identity-management%2Fpim-configure%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-830059%22%20slang%3D%22en-US%22%3ERe%3A%20Alerting%20if%20new%20Global%20Admin%20is%20added%20to%20tenant%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-830059%22%20slang%3D%22en-US%22%3EI%20have%20a%20built-in%20alert%20option%20for%20elevation%20of%20Exchange%20admin%20but%20nothing%20else%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Is it possible to set an alert on changes to the Global Admin role membership? Any direction would be most appreciated.

THX. Eric

 

3 Replies
Highlighted
Solution

@E Wuichner 

 

You can go to https://protection.office.com/unifiedauditlog and then click the new alert button, change the alert type from Custom to Elevation of Privileges, give the alert a name, description and then an email address for the alert to go to and then press save.

 

Hope that helps,

 

Iain.


clipboard_image_2.png

 

 

Highlighted

You should actually have a built-in alert for that under https://protection.office.com/alertpolicies

And the Azure AD Privileged Identity Management feature should also be mentioned: https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

Highlighted
I have a built-in alert option for elevation of Exchange admin but nothing else