This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 61%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESV%3C/text%3E%3C/svg%3E)
Hello
Azure AD accounts keep disabling.
How to find who doing this?
Hi,
Please look for Disable account entries in portal under Azure Active Directory -- Monitoring -- Audit logs as shown in screenshot below:
Audit logs in Azure Active Directory
https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs
If the above was helpful please Accept Answer.
Thanks.
-TP
Whose accounts disabled; all are getting below message:
Error Code:50057
Message::
The user account is disabled.
Remediation::
The user object in Active Directory backing this account has been disabled. An admin can re-enable this account through Powershell: https://learn.microsoft.com/powershell/module/addsadministration/enable-adaccount?view=win10-ps
Hi,
Please look at the audit log entries as I show in my screenshot, then click on one that is Disable account activity and check the details. It will show the user account that disabled the account.
-TP
Thank you for assisting on this.
From audit logs, I couldn't find who disabled user accounts.
In doc link it mentioned we can see who Initiated but I unable to find this.
Initiated by: Allows you to search by who initiated the activity using the first few letters of their name or UPN. The name and UPN are case-sensitive.
Please look at the screenshot I posted above. On yours, please click on Date: Last 24 hours and select Last 7 days, click Apply. In the list of entries, look for Disable account or Update user in the Activity column. You can click on each entry and it will show the user that made the change at the bottom. Additionally, you can check the Initiated by (actor) column for same information. If you don't see Initiated by column, click on the Columns button and make sure it is selected.
@Shameer Vali
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?
If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.
Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 11%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBR%3C/text%3E%3C/svg%3E)
How does this help to find what is causing the account to be disabled?
How does this help to find what is causing the account to be disabled?
@Braden Roof This allows you to see the user account that is doing the disabling. Once you know that you can investigate further.