Alert if 365 account status is changed from Sign-in blocked to allowed

Occasional Contributor

Hi community

Has anyone found a way to alert admins when an account sign-in ability has been unblocked?

Thank you for any assistance.

3 Replies
best response confirmed by ryeurolink (Occasional Contributor)




Forward your audit logs to Log Analytics Workspace, and create alerts for these events.


Example: Monitor your Azure AD Break Glass Accounts with Azure Monitor – Daniel Chronlund Cloud Tech Blog (da... 


Here is a KQL example for enabled accounts: 


| where OperationName == "Enable account"

Ah, brilliant, didn't think that Azure could do this without some sort of paid subscription.


I'll look into it, and thank you for your answer!


For Azure Monitor Log Analytics, you pay for data ingestion and data retention.

Depending on your amount of data, you will have to pay a few bucks per month, but the Free Tier will get you started for sure. 



Pricing - Azure Monitor | Microsoft Azure