Share via

how to get an alert of an unlicensed user if office365 authentication login

Mark Siguenza 20 Reputation points
2023-07-31T04:34:50.51+00:00

As you know, we change the display name of offboarded users to have a prefix of “zzz”. Eg.  zzz John Smith Users with this name prefix should not normally log on to O365 or Azure Services.

Is it possible to set up an email Alert to my my mailbox and to our IT Mailbox to indicate when an account with this prefix successfully authenticates?

We'd like to have it as an extra “soft” measure against unexpected logon activity.

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
4,363 questions
0 comments
Accepted answer
  1. Vasil Michev 100.2K Reputation points MVP
    2023-07-31T15:57:56.1166667+00:00

    Depends on what products you are using. Defender for cloud apps offers activity policies which you can use to configure such alerts. Another alternative would be to integrate the sign-in logs with Sentinel or a similar tool, and configure the alert therein, With "pure" O365 functionality best you can do is configure an activity alert, but those cannot be used with wildcards, so you will have to list each and every user.

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest