Hello - I know in Azure I can see unusual sign in locations and failed sign ins. I'm having trouble figuring out if as an admin I can get an email any time there is unusual sign in activity for any user in my organization. Any ideas on this one?
If you are using Azure AD Identity protection, there's a built-in email notification for "users at risk": https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protectio... If you want a notification for each "unusual" or "failed" sign in, you'll have to create your own solution based on the Azure AD sign-in log events. Keep in mind that in any reasonably sized organization you'll be looking at hundreds, if not thousands of emails per day.
