Forum Discussion
Admin report for unusual sign in activity
Hello - I know in Azure I can see unusual sign in locations and failed sign ins. I'm having trouble figuring out if as an admin I can get an email any time there is unusual sign in activity for any user in my organization. Any ideas on this one?
- If you are using Azure AD Identity protection, there's a built-in email notification for "users at risk": https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications#users-at-risk-detected-email
If you want a notification for each "unusual" or "failed" sign in, you'll have to create your own solution based on the Azure AD sign-in log events. Keep in mind that in any reasonably sized organization you'll be looking at hundreds, if not thousands of emails per day.
