Notify admin when user changes the password in O365

%3CLINGO-SUB%20id%3D%22lingo-sub-253003%22%20slang%3D%22en-US%22%3ENotify%20admin%20when%20user%20changes%20the%20password%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-253003%22%20slang%3D%22en-US%22%3E%3CP%3EIn%20security%20and%20compliance%20I%20have%20tried%20to%20create%20an%20alert%2C%20where%20I%20as%20an%20admin%20should%20receive%20an%20alert%20if%20any%20user%20in%20my%20domain%20changes%20the%20password.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ETried%20to%20create%20a%20DLP%20policy%20to%20link%20with%20an%20alter%20but%20there%20is%20no%20predefined%20policies%20and%20custom%20option%20is%20unavailable.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20someone%20let%20me%20know%2C%26nbsp%3Bhow%20can%20I%20get%20a%20notification%20or%20alert%20if%20any%20user%20in%20my%20domain%20tries%20to%20change%20the%20password%20or%20after.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-253003%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EChange%20Alerts%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOffice%20365%20Groups%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-253016%22%20slang%3D%22en-US%22%3ERe%3A%20Notify%20admin%20when%20user%20changes%20the%20password%20in%20O365%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-253016%22%20slang%3D%22en-US%22%3EYou%20cannot%20do%20this%20unless%20you%20write%20a%20plug%20in%20to%20the%20MS%20graph%20and%20query%20the%20audit%20log.%20You%20can%20set%20this%20up%20easily%20for%20notification%20for%20admin%20password%20changes.%20Self%20service%20password%20change%20requires%20the%20user%20to%20have%20registered%20their%20phone%20and%20so%20a%20password%20change%20means%20the%20extra%20user%20challenges%20have%20been%20passed%20and%20so%20a%20password%20change%20probably%20was%20done%20by%20the%20user%20and%20so%20you%20getting%20an%20alert%20just%20means%20you%20get%20more%20alerts%20that%20you%20need%2C%20which%20means%20you%20lose%20track%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

In security and compliance I have tried to create an alert, where I as an admin should receive an alert if any user in my domain changes the password.

 

Tried to create a DLP policy to link with an alter but there is no predefined policies and custom option is unavailable.

 

Can someone let me know, how can I get a notification or alert if any user in my domain tries to change the password or after.

1 Reply
Highlighted
You cannot do this unless you write a plug in to the MS graph and query the audit log. You can set this up easily for notification for admin password changes. Self service password change requires the user to have registered their phone and so a password change means the extra user challenges have been passed and so a password change probably was done by the user and so you getting an alert just means you get more alerts that you need, which means you lose track