Hello, We want to verify the person who has changed the Password Expiration Policy. In the Azure Active Directory and Compliance audit logs, we can't find any information. Do you have any idea.

Audit logs are where you should be looking, but they are only kept for a limited amount of time. If the action was performed outside of the audit log retention window, there is nothing you can do. Here's an example on how the audit trail will look like:

office 365 - How to find password expiration policy change logs

Mohamed Ali ABIDI 201

Hello,

We want to verify the person who has changed the Password Expiration Policy.

User's image

In the Azure Active Directory and Compliance audit logs, we can't find any information.

Do you have any idea.

Jame Xu-MSFT 4,176 Reputation points

2023-03-23T07:05:29.99+00:00

Hi @Mohamed Ali ABIDI ,

Just checking in to see if above information was helpful. Please let us know if you would like further assistance.

If the question has been answered, please accept the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well.

Accepted answer

Vasil Michev 103.9K Reputation points MVP

2023-03-22T15:56:55.97+00:00

Audit logs are where you should be looking, but they are only kept for a limited amount of time. If the action was performed outside of the audit log retention window, there is nothing you can do.

Here's an example on how the audit trail will look like:
Please sign in to rate this answer.

2 people found this answer helpful.
Mohamed Ali ABIDI 201 Reputation points

2023-03-23T11:21:20.18+00:00

@Vasil Michev Thanks for all the explanations

Nick 0 Reputation points

2023-03-31T21:09:30.0366667+00:00

Just to expand on this, you can utilize the Unifed Audit Logs (UAL) if you had them enabled, which can give you slightly longer-term results (90 days instead of 7/31, more depending on licensing). You will want to search by Activities > Set password policy.

UAL is accessible from the Microsoft 365 Defender portal (https://security.microsoft.com) or the Purview portal (https://compliance.microsoft.com).

If you find they are disabled, consider this your sign to turn them on!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

office 365 - How to find password expiration policy change logs

0 additional answers

Your answer