How to locate who enabled an authentication method

Question

I went to enable FIDO key functionality in a tenant and I found that it was already enabled. I would like to find out who enabled but I am not sure of the best way to search the audit logs to find out. I am aware that the event could have aged out of the logs due to retention times but I would at least like to make an effort. Any ideas would be appreciated.

Answer 1

Hi @jpcapone

Thank you for posting this in Microsoft Q&A.

I understand you would like to view audit logs to determine who enabled the FIDO key in your tenant.

Please follow the below steps

1.Sign in to the Microsoft Entra admin center as at least a Reports Reader.

2.Browse to Identity > Monitoring & health > Audit logs.

3.Please adjust the filters as shown in the screenshot below..

4.You can view the details of users who have enabled FIDO under the 'Initiated by Actor' section.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.