Struggling to track bulk user creations in your Microsoft 365 environment? This challenge can result in unintended consequences such as user accounts with excessive permissions or unnecessary licenses that increase both security risks and operational costs. But, no worries! This guide will show you how to audit user account creations effectively in Microsoft 365.
Windows PowerShell Connect-ExchangeOnline Windows PowerShell Search-UnifiedAuditLog -StartDate MM/DD/YYYY -EndDate MM/DD/YYYY -Operations "Add user" -ResultSize 5000 | Where-Object { ($_.AuditData | ConvertFrom-Json).Operation -eq "Add user." } | ft 
AdminDroid's Microsoft 365 user auditing tool provides deep insights into user account creations, deletions, and user modifications that helps to enhance M365 user management.
Export Microsoft 365 users reports in various formats including guest users with details, such as sign-in status, licenses, and location for easy analysis and updates.
Monitor recently created Microsoft 365 admin accounts and review their delegated privileges to prevent over-privileged access and reduce security risks.
Easily track newly created M365 users to detect unwanted or duplicate accounts and ensure that only legitimate users remain in your organization.
Receive scheduled reports on external user creation in M365 to quickly detect unnecessary accounts and enhance account oversight.
With AdminDroid's alerting feature, receive instant notifications whenever a new Microsoft 365 user is created in your organization.
Regularly audit disabled users in Microsoft 365 to determine whether to restore access or delete the accounts for efficient user management.
Thus, AdminDroid's Microsoft 365 Reporter provides detailed insights for auditing user creation activities with ease and precision. It helps admins track account creations, deletions, and license changes. This makes it easier to spot issues, ensure compliance, and maintain a secure and well-managed Microsoft 365 environment.
This error occurs when the start and end date are not correctly specified when executing the 'Search-UnifiedAuditLog' cmdlet in the PowerShell.
This error will occur in the Audit Log search of Purview compliance portal if the selected date and time range exceed the limit.
The script encounters this error because the current execution policy is set to "Restricted", which blocks script execution.
Set-ExecutionPolicy -ExecutionPolicy Unrestricted
This occurs when the CSV file contains invalid or incomplete data, such as missing required fields, incorrect formatting, or unsupported characters.
Admins will face significant security issues if they fail to track the Microsoft 365 user creations in their organization. Here are some of the most critical ones to consider.
In Microsoft 365, a service principal is a security identity used by applications and automated tools to access resources without a user account. When a service principal creates a user, it typically indicates an application or automated process, not an admin. Periodic tracking of this activity helps identify misconfigured applications, ensures compliance, prevents unauthorized privilege escalation, and maintains control over account creation.
While Microsoft Purview offers detailed audit logs for Microsoft 365 user creations, those are not user-friendly for admins. Instead, admins can use the PowerShell script below to easily identify user accounts created by service principals in their tenant.
Connect to the Exchange Online PowerShell module using the below cmdlet.
Connect-ExchangeOnlineRun the following script with the appropriate start date & end date to get the Microsoft 365 user accounts created by service principals.
Search-UnifiedAuditLog -StartDate MM/DD/YYYY -EndDate MM/DD/YYYY -Operations "Add user" -ResultSize 5000 | Where-Object { ($_.AuditData | ConvertFrom-Json).Operation -eq "Add user." } | ForEach-Object {
$auditData = ConvertFrom-Json $_.AuditData
[PSCustomObject]@{
CreationDate = $auditData.CreationTime
UserId = $auditData.UserId
User = $auditData.ObjectId
Operation = $auditData.Operation
}
} | Format-Table -AutoSize
Bulk user account creation is crucial for efficient Microsoft 365 administration, especially when handling numerous accounts during employee onboarding or in large organizations. Admins can add M365 users in bulk using manual input or CSV file uploads.
Get AdminDroid Office 365 Reporter Now!