![]() I asked Microsoft via a support ticket and they claimed there was nothing wrong and these were likely Sharepoint users or guests? But we do not use Sharepoint, and these users don't exist in our directory as guests or members. 'UserLoggedin' means a sucessful login, correct? We have scoured Azure AD for any reference to these accounts and found nothing. We have noticed entries in this AuditLog that show users that have never existed in our environment logging in from random countries. ![]() We use and alert on any sign-ins outside of the state we are located. It returns any action matching 'UserLoggedIn' and provides great info like user agent, IP address, country, etc. We recently started using a Powershell script that utilizes the 'Search-unifiedAuditLog' function.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |