25,130 questions
Yes, you can check the audit logs in Azure for that user for up to 30 days ( or longer if shipping logs )
You can also look here for resets:
Logs regarding MFA
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 5%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
Josef Mouri
0
Reputation points
Hello, I have a question regarding authentication and Azure, I know there's logs to check regarding authentication, but they're mostly who signed in and who registrered and when.
But is there a way to check logs regarding why a MFA was unregistrered for a user (so user had to re-register his MFA), logs regarding when this happened, etc.
Best regards.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Authenticator
9,309 questions
1 answer
Sort by: Most helpful
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator2023-06-08T13:51:14.51+00:00 -
Josef Mouri 0 Reputation points
2023-06-08T14:05:15.9466667+00:00 .....
-
Josef Mouri 0 Reputation points
2023-06-08T14:07:43.0533333+00:00 None of those shows the MFA reset, they all just show when he has registered MFA, so in registration and reset logs you simply see the two times the user has registered, but the point where he lost the MFA between those dates is missing.
Maby Azure just logs if you manually reset it as an admin, and if it happens sorta in a automatic process like maby related to a password reset, it doesn't log it?
-
Andy David - MVP 157.8K Reputation points MVP Volunteer Moderator
2023-06-08T14:55:39.7433333+00:00 If a password reset was required or the user may any change to their MFA, it would be in the Azure audit logs for that account
Sign in to comment -