Share via

outlook login IP addresses/ Audit logs

Ben Harden 21 Reputation points
2021-03-22T22:26:28.983+00:00

I have what is hopefully a simple question. I am an admin for a office 365 account. Our company has a number of email accounts, one for each employee. I know that if I go to the office 365 admin page then navigate to compliance and then to the audit logs page I can get a list of the IP addresses of the all the user's logins for the last three months. I want to be able to do this automatically through and API. I know the information exists because I can get it using the GUI on the website. Can anyone help me find the API where I can access this? I have looked in many locations in the docs and using 'graph' and have been unable to find a way to access this information other than on the website.
For background I am using these IP addresses to find the locations of the logins to help us know immediately when our emails have been compromised. If there is another way to do this through an API that does not involve getting the IP address I would accept that as a solution as well.

Community Center | Not monitored
Accepted answer
  1. Vasil Michev 119.8K Reputation points MVP Volunteer Moderator
    2021-03-23T08:59:16.07+00:00

    You have two options here:

    1. Use PowerShell to get the information from the Unified Audit Log (Search-UnifiedAuditLog) or from the Mailbox audit logs (Search-MailboxAuditLog)
    2. Use the Management Activity API to get the same info via REST-based HTTP requests: https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference
    1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.