This website uses cookies to improve your experience. We'll assume you're ok with this. Know more.

Microsoft 365 User Auditing

Monitoring Microsoft 365 user details, password changes, and admin roles are a prior task to secure the user accounts and prevent unwanted privilege assignments in the organization. Gathering and analyzing all the info together is backbreaking work with a native M365 auditing tool. So, AdminDroid decides to fulfil the loopholes and provide every info of users altogether in a single tool that facilitates admins to audit user account details efficiently.

Microsoft 365 User Auditing

Collect Stats on Admin Privileges

Identify MFA Disabled Users

Gather Trends on Deleted Users

Verify Sign-in Disabled Users

Analyze Self-service Password Resets

Track Password Resets by Admin

Collect Stats on Admin Privileges

Monitor admin privilege assignments to users like global admin, global reader, Exchange admin, Security admin, Compliance admin, and more.
Recognize how many users get assigned to a specific role.

Identify MFA Disabled Users

Recognize when and who disables MFA for users in the tenant.
Track how many times MFA gets disabled for a user over a period.

Gather Trends on Deleted Users

Obtain an overview of when and why users are deleted in the organization.
Identify how many users get deleted on a specified day.

Verify Sign-in Disabled Users

Monitor details on who tops the list in the user offboarding process in the organization.
Get how many sign-ins are disabled successfully in a month.

Analyze Self-service Password Resets

Recognize any potential security risks by viewing password reset times and reset frequency of a user account.
Get daily trends on self-service password resets in a tenant.

Track Password Resets by Admin

Identify how much time your users spend on password resets.
Verify top contributors in resetting user passwords in the organization.

polygon-img

polygon-img

polygon-img

polygon-img

Microsoft 365 User Audit

As an admin, it is very important to audit all the Microsoft 365 user-related activities like user creations, Microsoft 365 user license changes, and user deletion. For monitoring all these activities, AdminDroid helps admins by providing all the Microsoft 365 user reports with clear-cut insights. The reports under this category help you to identify the management actions performed on users in your Microsoft 365 environment.

Created Users

Audit the user objects created in your Azure AD.

Microsoft 365 User Creations

Whenever Microsoft 365 users are created in Azure Active Directory, the user creation events get listed in this report. It helps admins to identify who creates which user account.
It also shows whether the activity succeeds or not. Export the Microsoft 365 user creation report, for future usage.

Updated Users

Audit the changed user properties.

Microsoft 365 User Modifications

In this report, all the audit events triggered when any of the Office 365 user properties were changed. It also shows the detailed info of users who changed other users' properties.
Viewing this report helps admins to identify the changes made in the user properties.

Audit Deleted Users

Audit the deleted user object events.

Microsoft 365 User Deletions

This report shows the list of user deletion events in the organization.
Analyzing this report helps admins to restore a deleted Microsoft 365 user or to purge the deleted users from Microsoft 365 if needed. Export the deleted Microsoft 365 user to monitor the insights further.

Audit Sign-in Re-Enabled Users

Audit the events of re-enabling the sign-in blocked users.

Microsoft 365 Sign-in Enabled Users

In this report, the list of sign-in blocked users whose sign-in is re-enabled by admins in your organization is available.
Viewing the Microsoft 365 enabled users report helps admins to monitor the sign-in re-enabled user accounts.
Also, it shows the respective username, enabled time, admin name who enabled the account, and more.

Audit Sign-in Disabled Users

Audit the events of blocking user sign-ins.

Microsoft 365 Sign-in Disabled Users

Admins can audit the Microsoft 365 sign-in blocked users in the organization with the help of this report.
Microsoft 365 disabled users report help admins to re-enable sign-in for sign-in blocked users if needed.
Also, it shows the disabled username, disabled time, admin name who disabled the user, etc.

License Changes

Audit the license assign / revoke operation performed in your tenant.

Users' License Changes

If an Microsoft 365 license is assigned or revoked to any Microsoft 365 users in the organization, the corresponding triggered events are listed here.
It shows the activity successful status and the M365 license assignment date. Admins can identify the license changes details and other related details in this report.

Group based License Changes

Lists all the activities on group-based license changes in your Office 365 environment.

Group-based License Changes

It shows the list of group members assigned with group-based licenses in the organization. This report shows the activity time, username, group name, group-based license assignment, etc.
Viewing this report helps admins to audit the undesired group-based license assignment changes done in their Microsoft 365 environment.

MFA(Multi-factor Authentication) Enabled

Administrator has enabled the multi-factor authentication method.

Microsoft 365 MFA Enabled Users

This report lists the event whenever an MFA is enabled to users by the admin in Microsoft 365 environment. It helps admins to identify who enabled MFA for whom.
Viewing this report, admins can insist users to activate the MFA to secure their account.

MFA(Multi-factor Authentication) Disabled

Administrator has disabled the multi-factor authentication method.

Microsoft 365 MFA Disabled Users

All the Office 365 users whose MFA is disabled by the admins gets listed in this report. It shows the MFA disabled time, user, respective admin name, etc.
Auditing this report helps admins to identify and enable MFA to the MFA disabled users in the organization if required.

All User Administrative Events

Audit the operations performed on user objects.

Microsoft 365 User Events

All the events related to Microsoft 365 users’ activity in Azure Active Directory are listed here. It also shows that who performed the activity.
By viewing this report, admins can get all the Microsoft 365 user events occurred in AAD. Export the Microsoft 365 user activity report to find the activity of users for further analysis.

Microsoft 365 User Password Changes

For every Microsoft 365 account, the password is a major thing to protect data against malware, threats, data theft, etc. So, Microsoft 365 users must change their passwords after any risky activity is found or the admin resets the passwords. As an Microsoft 365 admin, monitoring password-related events is a foremost task. So, they can control any suspicious activities inside the organization. Refer to the following AdminDroid reports for Password change events.

Password Reset by Admin

Password reset done by admins.

Microsoft 365 Password Reset by Admin

If the Office 365 password has expired or any anonymous activities found, admins can force change/reset the passwords for any Office 365 user.
The list of the Office 365 password reset activities done by admins is available in this report. Also, it shows the password reset time.
Analyze this report to track the password resets by an Office 365 admin in the organization.

User Password Changes

Audit the password change events done by users.

Microsoft 365 User Password Changes

Any Office 365 user who wish to give hard-to-find passwords and avoid password expiry can change their Office 365 passwords. These password changes events done by users are listed here.
It gives you the details that who changed the password and whether it succeeds or not. Admins can identify the user password changes details in this report.

Admin Configured a Setting to Force Change User Password

Audits when an admin set the property that forces user to change the password.

Password Reset Forced by Admin

This report gives all the events which are triggered when an Office 365 admin forces the password reset for any of the Office 365 users. It shows info about who forced password reset for whom.
Viewing the force password change in the Office 365 report helps admins identify the user accounts, which are forced to reset their password.

Self Service Password Resets

Audits the self service password reset events.

Microsoft 365 Self-service Password Resets

This report shows a list of all the Office 365 user accounts that resets their passwords by using self-service password resets. It shows the password reset time along with the result status.
By analyzing this report admins can monitor all the self-service password resets and prevent the unauthorized usage of the user account.

All Password Changes

All the events related to password changes.

Microsoft 365 Password Changes

All the audit events related to the Microsoft 365 password changes done in your organization are listed here. It shows whether the Microsoft 365 admin or Microsoft 365 user, done the respective activity.
Admins can prevent unnecessary password changes and resets in the Microsoft 365 environment by viewing this report.
Export the password change history report to analyze the password changes for any user in future.

Users Added as Admins

Microsoft offers different business services which require an admin to manage user data. The Microsoft 365 admin center provides various admin roles to grant the least privileged access to users based on their responsibilities. It's crucial to assign admin roles based on the user's activities and monitor users' admin roles to avoid unnecessary admin privilege assignments. Admins can use the AdminDroid Microsoft 365 reporting tool to export a list of users with different admin roles to keep track of them. AdminDroid enables admins to monitor which users have been added to the various Microsoft 365 admin roles.

Users Added to Global Administrator Role

Audit the users who are being added as Global Administrator.

Global Admin

Being the 'Jack of all trades in Office 365', a global admin has the power to manage every aspect of an organization's infrastructure, from top-level security to granular user permissions.
This report helps you investigate potential unauthorized changes to global admin roles by covering all users added as global admins.

Users Added to Global Reader Role

Audit the users who are being added as Global Reader.

Global Reader

A global reader is a global admin lite, except that they can only view the admin features & settings and are unable to edit any of the settings.
The report provides an organization-wide list of all users with global reader access to ensure that only the appropriate users have access to sensitive enterprise data.

Users Added to Exchange Administrator Role

Audit the users who are being added as Exchange Administrator.

Exchange Admin

An 'Exchange Expert' oversees email services and manages user mailboxes, server settings, backups, and email security to ensure email system reliability
Be sure to monitor the Exchange admin access list report to prevent email problems like service outages, unauthorized access, and permissions.

Users Added to SharePoint Administrator Role

Audit the users who are being added as SharePoint Administrator.

Sharepoint Admin

A SharePoint administrator is the point person whose key responsibilities involve site management, site storage limit handling, and sharing setting configurations.
Use this 'user added as SharePoint administrators' report to ensure that only authorized personnel have administrative access to your SharePoint environment.

Users Added to Teams Service Administrator Role

Audit the users who are being added as Teams Service Administrator.

Teams Service Admin

Teams service admin is the primary administrator for Teams, responsible for managing your entire Microsoft Teams admin center from org-wide settings plus all configuration and policies.
By identifying the malicious insider who was elevated to Teams administrator role using this report, you can prevent a significant loss of reputation and financial resources.

Users Added to Kaizala Administrator Role

Audit the users who are being added as Kaizala Service Administrator.

Kaizala Admin

Kaizala admins manage the entire Kaizala network and app features, monitor usage, and ensure that the app is used effectively and securely within the organization.
Using Kaizala's administrators' report, monitor, and manage access to the Kaizala network proactively, and reduce the risk of unauthorized access.

Users Added to Skype Administrator Role

Audit the users who are being added as Skype Administrator.

Skype Admin

The Skype admin orchestrates the many components of the Skype for Business service, configuring the settings, monitoring usage, and managing Skype-specific user attributes in Azure AD.
Use this 'users added as Skype admins' report and ensure no sensitive data has been leaked or modified by users with improper permissions.

Users Added to PowerBI Administrator Role

Audit the users who are being added as PowerBI Administrator.

PowerBI Admin

Power BI admins are the 'Office 365 Report Handler' and have complete control over org-wide Power BI settings, usage metrics, and administrative features.
This report assists us in obtaining important visibility and ensures that only the right Microsoft 365 users have access to your organization reports.

User Added to Azure DevOps Authentication Administrator Role

Audit the users who are being added as Azure DevOps Administrator.

Azure DevOps Admin

Azure DevOps administrators have access to organizations tied to your company's Azure AD, so they may inadvertently or maliciously impact groups in another organization.
In this report, you can view the list of users who are granted access as Azure DevOps admin and proactively monitor to prevent any mismanagement of user access privileges.

User Added to Azure Information Protection Administrator Role

Audit the users who are being added as Azure Information Protection Administrator.

Azure Info Protection Admin

'Azure Information Protection Service Whiz' manages the AIP service, including configuring labels, managing templates, and activating protections.
By using this report, organizations can ensure that any AIP administrators who leave or change roles are appropriately updated or revoked to prevent unauthorized access to sensitive information.

Users Added to Billing Administrator Role

Audit the users who are being added as Billing Administrator.

Billing Admin

The 'Office 365 billing administrator' manages subscriptions and payment details to ensure that the company's service is uninterrupted and payments are made on schedule.
Admins can revoke billing admin permissions from users who no longer require access to confidential billing information by using the 'user added as billing admin' report and prevent unauthorized use of financial data.

Users Added to Privileged Authentication Administrator Role

Audit the users who are being added as Privileged Authentication Administrator.

Privileged Auth Admin

The privileged authentication administrator manages MFA, password policies, and access control policies for users with elevated privileges to maintain the security of Office 365 resources.
Use this report to ensure no end-users are elevated to privileged auth admins since they can reset global admins' passwords.

Users Added to Compliance Administrator Role

Audit the users who are being added as Compliance Administrator.

Compliance Admin

Compliance administrators are 'security chiefs' in an Office 365 environment, responsible for ensuring that an organization adheres to strong regulatory requirements, manages eDiscovery cases, and maintains data governance policies.
This report provides visibility into the list of users added as compliance admins and lets you ensure only the right individuals are responsible for managing compliance features.

Users Added to Compliance Data Administrator Role

Audit the users who are being added as Compliance Data Administrator.

Compliance Data Admin

Rather than being focused on all compliance features, compliance data admins are responsible for managing compliance features that are specific to data protection and governance.
This report highly helps to monitor changes to their compliance data admin roles, enabling them to maintain an up-to-date and accurate record of all users with access to compliance-related features.

Users Added to Search Administrator Role

Audit the users who are being added as Search Administrator.

Search Admin

'Office 365 Search Configuration Manager' manages search schema, monitors performance, configures settings, and fine-tunes search results so users can search for information quickly and effectively.
By reviewing this report, you can ensure that only authorized individuals have access to search configuration, helping to protect sensitive content and reducing the risk of data exposure.

Users Added to Helpdesk Administrator Role

Audit the users who are being added as Helpdesk Administrator.

Helpdesk Admin

The ‘Office 365 Support Jedi’ alias Helpdesk Administrator handles service requests, troubleshoots user problems, and monitors service health in your Office 365 enterprise.
With this report, you can uncover inappropriate granting of Helpdesk admin privileges to non-IT personnel or users who no longer need such access.

Users Added to Service Administrator Role

Audit the users who are being added as Service Administrator.

Service Admin

A 'Service support administrator' is responsible for managing support requests, responding to user requests, and managing incidents related to Office 365 services.
Users added as a service support administrator's report allows administrators to discover unauthorized consents and enforce strong access controls against it.

Users Added to Office Apps Administrator Role

Audit the users who are being added as Office Apps Administrator.

Office Apps Admin

Office app administrators oversee the deployment, configuration, and maintenance of Microsoft 365 applications to ensure optimal functionality and effective use.
This report provides greater insight into who has access to the Office Apps administrator role, assisting administrators with access control management.

Users Added to Printer Administrator Role

Audit the users who are being added as Printer Administrator.

Printer Admin

The 'Printer administrator' is wholly responsible for managing all aspects of printers, including the ability to register printers, manage print settings, and generate printable reports.
You can use this report to monitor users with access to the printer administrator role to prevent unauthorized changes to printer configurations, which may negatively affect printing performance.

reports

Click image to expand