I setup an Office365/Azure tenancy for a small charity I help. I am keen to setup automated reporting that sends an email when someone logs in as an admin account (i.e with a particular role or group).
The main things I am trying to achieve are
- Visibility of when a 3rd party support organisation logging in to change the tenancy
- Visibility of when an internal staff member logs in, including staff who have moved on and we believe their accounts are disabled
- Visibility of unknown accounts logging in (i.e. a newly created admin account by a nefarious actor)
All I have been able to find is how to alert on a specific user, which can help with the first 2 requirements (although it means setting up an alert per account), however it doesn't cover the 3rd requirement.
Is it possible to setup an alert in Azure to send an email to a nominated address when any account with the Global Admin role logs in ?
Azure AD Sign-In logs contain the information you need to detect when someone signs in. You can export these logs to a Log Analytics workspace and then setup an alert for when someone signs in with a Global Admin role.
This article has some step-by-step details on how it can be done.