Monitoring Microsoft 365 user details, password changes, and admin roles are a prior task to secure the user accounts and prevent unwanted privilege assignments in the organization. Gathering and analyzing all the info together is backbreaking work with a native M365 auditing tool. So, AdminDroid decides to fulfil the loopholes and provide every info of users altogether in a single tool that facilitates admins to audit user account details efficiently.
CSV
Excel
HTML
Raw
Monitor admin privilege assignments to users like global admin, global reader, Exchange admin, Security admin, Compliance admin, and more.
Recognize how many users get assigned to a specific role.
Recognize when and who disables MFA for users in the tenant.
Track how many times MFA gets disabled for a user over a period.
Obtain an overview of when and why users are deleted in the organization.
Identify how many users get deleted on a specified day.
Monitor details on who tops the list in the user offboarding process in the organization.
Get how many sign-ins are disabled successfully in a month.
Recognize any potential security risks by viewing password reset times and reset frequency of a user account.
Get daily trends on self-service password resets in a tenant.
Identify how much time your users spend on password resets.
Verify top contributors in resetting user passwords in the organization.
As an admin, it is very important to audit all the Microsoft 365 user-related activities like user creations, Microsoft 365 user license changes, and user deletion. For monitoring all these activities, AdminDroid helps admins by providing all the Microsoft 365 user reports with clear-cut insights. The reports under this category help you to identify the management actions performed on users in your Microsoft 365 environment.
Audit the user objects created in your Azure AD.
Whenever Microsoft 365 users are created in Azure Active Directory, the user creation events get listed in this report. It helps admins to identify who creates which user account.
It also shows whether the activity succeeds or not. Export the Microsoft 365 user creation report, for future usage.
Audit the changed user properties.
In this report, all the audit events triggered when any of the Office 365 user properties were changed. It also shows the detailed info of users who changed other users' properties.
Viewing this report helps admins to identify the changes made in the user properties.
Audit the deleted user object events.
This report shows the list of user deletion events in the organization.
Analyzing this report helps admins to restore a deleted Microsoft 365 user or to purge the deleted users from Microsoft 365 if needed. Export the deleted Microsoft 365 user to monitor the insights further.
Audit the events of re-enabling the sign-in blocked users.
In this report, the list of sign-in blocked users whose sign-in is re-enabled by admins in your organization is available.
Viewing the Microsoft 365 enabled users report helps admins to monitor the sign-in re-enabled user accounts.
Also, it shows the respective username, enabled time, admin name who enabled the account, and more.
Audit the events of blocking user sign-ins.
Admins can audit the Microsoft 365 sign-in blocked users in the organization with the help of this report.
Microsoft 365 disabled users report help admins to re-enable sign-in for sign-in blocked users if needed.
Also, it shows the disabled username, disabled time, admin name who disabled the user, etc.
Audit the license assign / revoke operation performed in your tenant.
If an Microsoft 365 license is assigned or revoked to any Microsoft 365 users in the organization, the corresponding triggered events are listed here.
It shows the activity successful status and the M365 license assignment date. Admins can identify the license changes details and other related details in this report.
Lists all the activities on group-based license changes in your Office 365 environment.
It shows the list of group members assigned with group-based licenses in the organization. This report shows the activity time, username, group name, group-based license assignment, etc.
Viewing this report helps admins to audit the undesired group-based license assignment changes done in their Microsoft 365 environment.
Administrator has enabled the multi-factor authentication method.
This report lists the event whenever an MFA is enabled to users by the admin in Microsoft 365 environment. It helps admins to identify who enabled MFA for whom.
Viewing this report, admins can insist users to activate the MFA to secure their account.
Administrator has disabled the multi-factor authentication method.
All the Office 365 users whose MFA is disabled by the admins gets listed in this report. It shows the MFA disabled time, user, respective admin name, etc.
Auditing this report helps admins to identify and enable MFA to the MFA disabled users in the organization if required.
Audit the operations performed on user objects.
All the events related to Microsoft 365 users’ activity in Azure Active Directory are listed here. It also shows that who performed the activity.
By viewing this report, admins can get all the Microsoft 365 user events occurred in AAD. Export the Microsoft 365 user activity report to find the activity of users for further analysis.
For every Microsoft 365 account, the password is a major thing to protect data against malware, threats, data theft, etc. So, Microsoft 365 users must change their passwords after any risky activity is found or the admin resets the passwords. As an Microsoft 365 admin, monitoring password-related events is a foremost task. So, they can control any suspicious activities inside the organization. Refer to the following AdminDroid reports for Password change events.
Password reset done by admins.
If the Office 365 password has expired or any anonymous activities found, admins can force change/reset the passwords for any Office 365 user.
The list of the Office 365 password reset activities done by admins is available in this report. Also, it shows the password reset time.
Analyze this report to track the password resets by an Office 365 admin in the organization.
Audit the password change events done by users.
Any Office 365 user who wish to give hard-to-find passwords and avoid password expiry can change their Office 365 passwords. These password changes events done by users are listed here.
It gives you the details that who changed the password and whether it succeeds or not. Admins can identify the user password changes details in this report.
Audits when an admin set the property that forces user to change the password.
This report gives all the events which are triggered when an Office 365 admin forces the password reset for any of the Office 365 users. It shows info about who forced password reset for whom.
Viewing the force password change in the Office 365 report helps admins identify the user accounts, which are forced to reset their password.
Audits the self service password reset events.
This report shows a list of all the Office 365 user accounts that resets their passwords by using self-service password resets. It shows the password reset time along with the result status.
By analyzing this report admins can monitor all the self-service password resets and prevent the unauthorized usage of the user account.
All the events related to password changes.
All the audit events related to the Microsoft 365 password changes done in your organization are listed here. It shows whether the Microsoft 365 admin or Microsoft 365 user, done the respective activity.
Admins can prevent unnecessary password changes and resets in the Microsoft 365 environment by viewing this report.
Export the password change history report to analyze the password changes for any user in future.
Microsoft offers different business services which require an admin to manage user data. The Microsoft 365 admin center provides various admin roles to grant the least privileged access to users based on their responsibilities. It's crucial to assign admin roles based on the user's activities and monitor users' admin roles to avoid unnecessary admin privilege assignments. Admins can use the AdminDroid Microsoft 365 reporting tool to export a list of users with different admin roles to keep track of them. AdminDroid enables admins to monitor which users have been added to the various Microsoft 365 admin roles.
Audit the users who are being added as Global Administrator.
Being the 'Jack of all trades in Office 365', a global admin has the power to manage every aspect of an organization's infrastructure, from top-level security to granular user permissions.
This report helps you investigate potential unauthorized changes to global admin roles by covering all users added as global admins.
Audit the users who are being added as Global Reader.
A global reader is a global admin lite, except that they can only view the admin features & settings and are unable to edit any of the settings.
The report provides an organization-wide list of all users with global reader access to ensure that only the appropriate users have access to sensitive enterprise data.
Audit the users who are being added as Exchange Administrator.
An 'Exchange Expert' oversees email services and manages user mailboxes, server settings, backups, and email security to ensure email system reliability
Be sure to monitor the Exchange admin access list report to prevent email problems like service outages, unauthorized access, and permissions.
Audit the users who are being added as SharePoint Administrator.
A SharePoint administrator is the point person whose key responsibilities involve site management, site storage limit handling, and sharing setting configurations.
Use this 'user added as SharePoint administrators' report to ensure that only authorized personnel have administrative access to your SharePoint environment.
Audit the users who are being added as Teams Service Administrator.
Teams service admin is the primary administrator for Teams, responsible for managing your entire Microsoft Teams admin center from org-wide settings plus all configuration and policies.
By identifying the malicious insider who was elevated to Teams administrator role using this report, you can prevent a significant loss of reputation and financial resources.
Audit the users who are being added as Kaizala Service Administrator.
Kaizala admins manage the entire Kaizala network and app features, monitor usage, and ensure that the app is used effectively and securely within the organization.
Using Kaizala's administrators' report, monitor, and manage access to the Kaizala network proactively, and reduce the risk of unauthorized access.
Audit the users who are being added as Skype Administrator.
The Skype admin orchestrates the many components of the Skype for Business service, configuring the settings, monitoring usage, and managing Skype-specific user attributes in Azure AD.
Use this 'users added as Skype admins' report and ensure no sensitive data has been leaked or modified by users with improper permissions.
Audit the users who are being added as PowerBI Administrator.
Power BI admins are the 'Office 365 Report Handler' and have complete control over org-wide Power BI settings, usage metrics, and administrative features.
This report assists us in obtaining important visibility and ensures that only the right Microsoft 365 users have access to your organization reports.
Audit the users who are being added as Azure DevOps Administrator.
Azure DevOps administrators have access to organizations tied to your company's Azure AD, so they may inadvertently or maliciously impact groups in another organization.
In this report, you can view the list of users who are granted access as Azure DevOps admin and proactively monitor to prevent any mismanagement of user access privileges.
Audit the users who are being added as Azure Information Protection Administrator.
'Azure Information Protection Service Whiz' manages the AIP service, including configuring labels, managing templates, and activating protections.
By using this report, organizations can ensure that any AIP administrators who leave or change roles are appropriately updated or revoked to prevent unauthorized access to sensitive information.
Audit the users who are being added as Billing Administrator.
The 'Office 365 billing administrator' manages subscriptions and payment details to ensure that the company's service is uninterrupted and payments are made on schedule.
Admins can revoke billing admin permissions from users who no longer require access to confidential billing information by using the 'user added as billing admin' report and prevent unauthorized use of financial data.
Audit the users who are being added as Privileged Authentication Administrator.
The privileged authentication administrator manages MFA, password policies, and access control policies for users with elevated privileges to maintain the security of Office 365 resources.
Use this report to ensure no end-users are elevated to privileged auth admins since they can reset global admins' passwords.
Audit the users who are being added as Compliance Administrator.
Compliance administrators are 'security chiefs' in an Office 365 environment, responsible for ensuring that an organization adheres to strong regulatory requirements, manages eDiscovery cases, and maintains data governance policies.
This report provides visibility into the list of users added as compliance admins and lets you ensure only the right individuals are responsible for managing compliance features.
Audit the users who are being added as Compliance Data Administrator.
Rather than being focused on all compliance features, compliance data admins are responsible for managing compliance features that are specific to data protection and governance.
This report highly helps to monitor changes to their compliance data admin roles, enabling them to maintain an up-to-date and accurate record of all users with access to compliance-related features.
Audit the users who are being added as Search Administrator.
'Office 365 Search Configuration Manager' manages search schema, monitors performance, configures settings, and fine-tunes search results so users can search for information quickly and effectively.
By reviewing this report, you can ensure that only authorized individuals have access to search configuration, helping to protect sensitive content and reducing the risk of data exposure.
Audit the users who are being added as Helpdesk Administrator.
The ‘Office 365 Support Jedi’ alias Helpdesk Administrator handles service requests, troubleshoots user problems, and monitors service health in your Office 365 enterprise.
With this report, you can uncover inappropriate granting of Helpdesk admin privileges to non-IT personnel or users who no longer need such access.
Audit the users who are being added as Service Administrator.
A 'Service support administrator' is responsible for managing support requests, responding to user requests, and managing incidents related to Office 365 services.
Users added as a service support administrator's report allows administrators to discover unauthorized consents and enforce strong access controls against it.
Audit the users who are being added as Office Apps Administrator.
Office app administrators oversee the deployment, configuration, and maintenance of Microsoft 365 applications to ensure optimal functionality and effective use.
This report provides greater insight into who has access to the Office Apps administrator role, assisting administrators with access control management.
Audit the users who are being added as Printer Administrator.
The 'Printer administrator' is wholly responsible for managing all aspects of printers, including the ability to register printers, manage print settings, and generate printable reports.
You can use this report to monitor users with access to the printer administrator role to prevent unauthorized changes to printer configurations, which may negatively affect printing performance.
Manage external users, guest users, contacts, managers and direct reports, admins, disabled users, and more in the organization effortlessly.
Reduce the license cost with precise details about licensed users, unlicensed users, license usage, subscriptions, trial, free licenses, etc.
Obtain details on users with and without MFA, enabled users, enforced users, MFA non-activated users, etc., in your organization.
Take a look at password expiry, never expire passwords, soon-to-expire users, passwords not changed in 90 days, weak passwords, and more.
Monitor failed user logins, successful logins, last logon time, and risky login attempts like expired password logins, MFA challenge failures, admin’s login failures, etc.
Gain insights on global admin additions, admin access removals, role assignments, role scope changes, role creation and deletion, role changes, and more in the organization.
