Alert if 365 account status is changed from Sign-in blocked to allowed

[ryeurolink]

Hi community

Has anyone found a way to alert admins when an account sign-in ability has been unblocked?

Thank you for any assistance.

[#2 · Accepted solution]

@ryeurolink 

Yes. 

Forward your audit logs to Log Analytics Workspace, and create alerts for these events.

Example: Monitor your Azure AD Break Glass Accounts with Azure Monitor – Daniel Chronlund Cloud Tech Blog (da... 

Here is a KQL example for enabled accounts: 

AuditLogs

| where OperationName == "Enable account"

[#3]

@JanBakkerOrphaned 
Ah, brilliant, didn't think that Azure could do this without some sort of paid subscription.

I'll look into it, and thank you for your answer!

[#4]

@ryeurolink 

For Azure Monitor Log Analytics, you pay for data ingestion and data retention.

Depending on your amount of data, you will have to pay a few bucks per month, but the Free Tier will get you started for sure. 

See:

Pricing - Azure Monitor | Microsoft Azure