Admin report for unusual sign in activity

Copper Contributor

Hello - I know in Azure I can see unusual sign in locations and failed sign ins. I'm having trouble figuring out if as an admin I can get an email any time there is unusual sign in activity for any user in my organization. Any ideas on this one?

1 Reply
If you are using Azure AD Identity protection, there's a built-in email notification for "users at risk":
If you want a notification for each "unusual" or "failed" sign in, you'll have to create your own solution based on the Azure AD sign-in log events. Keep in mind that in any reasonably sized organization you'll be looking at hundreds, if not thousands of emails per day.