Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community

Admin report for unusual sign in activity

Copper Contributor

Hello - I know in Azure I can see unusual sign in locations and failed sign ins. I'm having trouble figuring out if as an admin I can get an email any time there is unusual sign in activity for any user in my organization. Any ideas on this one?

1 Reply
If you are using Azure AD Identity protection, there's a built-in email notification for "users at risk": https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protectio...
If you want a notification for each "unusual" or "failed" sign in, you'll have to create your own solution based on the Azure AD sign-in log events. Keep in mind that in any reasonably sized organization you'll be looking at hundreds, if not thousands of emails per day.