Azure AD Enhanced Auditing and Activity Logging now in preview!

[Alex Simons (AZURE)]

First published on CloudBlogs on Oct, 10 2014
Howdy folks, Many of you have asked for the ability to access audit and activity logs to ensure compliance or investigate issues. I'm excited to share that we've released four new reports in Preview that give you VERY detailed views of user activity in the organization. This first preview includes key directory events. In subsequent updates you'll see us add quite a few more events. To get you started, I've asked Ruchi Chopra, the Program Manager for Azure AD Reporting, to give you a detailed walkthrough of the capabilities we've released. As always, we'd love to receive any feedback or suggestions you have. Regards, Alex Simons (Twitter: @Alex_A_Simons ) Director of PM Active Directory Team -------------------------------------------------------------------------------------------------------------------------------- Hi everyone, We've heard how important it is for you to get data on activity within Azure AD to meet your operational and compliance needs. Multiple teams have worked together to release these much-anticipated reports, and I'm excited to share them with you today. We've released four new reports in preview

• Audit
• Password reset activity
• Password reset registration activity
• Group activity

Audit Report

This report is available in the Reports tab. It provides up to 30 days of data representing key changes in the directory. We provide the action, timestamp, the user/application that performed the action, and the user/application on which the action was performed. We realize how critical this report is for organizations, so it's available for free.

Data provided

We currently log over 30 events, including-

• Changes in role membership (ex: user added to Global Admin role)
• Credential updates (ex: password changes)
• Domain management (ex: verifying a custom domain, removing a domain)
• Adding or removing applications
• User management (ex: adding, removing, updating a user)
• Adding or removing licenses

Next steps

We have a few enhancements planned already:

• Include more events and also more detail about events (ex: previous and new values)
• Provide data for a longer time period
• Allow reports to be viewed by designated users who are not global admins
• Provide programmatic access to this report (and our other reports as well)

Password reset reports

These provide the admin with insights into how actively password reset is being used in the organization. You'll find them in the Reports tab as well. Password reset activity provides the history of resets done (within the last month). A key insight it provides is the methods being used (mobile phone/office phone/alternate email).

Password reset registration activity provides insights into which users have registered their methods for password reset, and which methods they have selected. This is important in determining the organization's readiness to use the password reset feature.

Next steps

We plan to release the following enhancements soon:

• Add detailed information about password reset failures to the password reset activity report
• Add a password reset dashboard showing key information about how many users are enabled and registered for password reset, as well as at-a-glance information about how password reset is being used day-to-day
• Add a registration status report which tells you which users are registered and which users are not, giving you an easy way to get your entire org registered for the password reset capability
• Provide the data for a longer time period

Group Activity report

This report is available in the Groups tab. Select a group and click on the Activity tab. It provides a history of changes to the group (ex: users added or removed) that were initiated in the Access Panel.

Filtering results in reports

You can select any time range within the last 30 days. Additionally, you can filter results by clicking on the on the top right of the grid. This will do a "contains" search on any of the columns in the report. We're working to provide enhanced filtering which will allow you to search within a specific column.

Downloading report data

In the portal you can view up to 1000 most recent results. However, you can download the report as a CSV file to get more data (up to 75000 rows), and open the file in the application of your choice for additional filtering or analysis. To download, click on the Download button at the bottom of the report. Let us know if you have any other ideas or suggestions. We'd love to hear from you! -Ruchi