Share via

SSPR not enabled. But still see ******@support.onmicrosoft.com in Audit logs

LaBenne, Jordan 31 Reputation points
2021-11-04T17:42:10.147+00:00

I keep seeing this user account show up in our audit logs. ******@support.onmicrosoft.com Reading from a pervious post the user account is used with SSPR. But we do not have SSPR enabled for our instance. What else is this account being used for.

Microsoft Security | Microsoft Entra | Microsoft Entra ID
Accepted answer
  1. Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator
    2021-11-09T20:07:23.37+00:00

    The ******@support.onmicrosoft.com account is logged by design today as certain operations such as SSPR and MFA registration are done. If the user has registered a strong authentication method (Multi-factor Authentication), this happens in the backend with the principal ******@support.onmicrosoft.com being the actor. This is an expected behavior.

    The event occurs not only for SSPR, but can also be recorded for MFA registration, or when an admin reset the user's password.

    Let me know if this helps answer your question.

    2 people found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.