SOLVED

Alert if 365 account status is changed from Sign-in blocked to allowed

Occasional Contributor

Hi community

Has anyone found a way to alert admins when an account sign-in ability has been unblocked?

Thank you for any assistance.

3 Replies
best response confirmed by ryeurolink (Occasional Contributor)
Solution

@ryeurolink 

 

Yes. 

Forward your audit logs to Log Analytics Workspace, and create alerts for these events.

 

Example: Monitor your Azure AD Break Glass Accounts with Azure Monitor – Daniel Chronlund Cloud Tech Blog (da... 

 

Here is a KQL example for enabled accounts: 

 

AuditLogs
| where OperationName == "Enable account"

@JanBakkerOrphaned 
Ah, brilliant, didn't think that Azure could do this without some sort of paid subscription.

 

I'll look into it, and thank you for your answer!

@ryeurolink 

For Azure Monitor Log Analytics, you pay for data ingestion and data retention.

Depending on your amount of data, you will have to pay a few bucks per month, but the Free Tier will get you started for sure. 

 

See:

Pricing - Azure Monitor | Microsoft Azure