Ability to audit when staff are registering and managing their domain account.


  • I am using the Monitoring - Audit Logs to look at the logs of our users authenticating with their domain accounts.   I would like to see the volume of staff registering, unlocking, and resetting passwords for their accounts so that I can measure the value of Azure.

    The challenge is there are so many events that I can only download the last 5000 events, which doesn't even give me a full 24 hours of activity.  I would like the last 30 days or last month of activity.

    So I have been filtering the view using the Activity drop down, but there appears to be multiple Activity titles for every action, making it difficult to get a full picture.

    Is there a good way to do this?


    Friday, January 11, 2019 7:16 PM

All replies

  • Hi Shodaman, you mentioned above " I am using the Monitoring - Audit logs..."

    can you please elaborate on the Azure service you are currently using so I know how to provide guidance? Is this Azure Log analytics?


    Tuesday, January 15, 2019 7:04 PM
  • Hello, Are you using AAD Premium? If not, you may need to purchase that and you will get all the reporting that you need.

    Hope that helps,

    Isaac Oben MCITP:EA, MCSE,MCC <a href=""> View my MCP Certifications</a>

    Wednesday, January 16, 2019 6:08 AM
  • In line with Isaac's comments above, I recommend starting with this doc as it gives you insight on the Auditing and logging features AAD supports. 
    Wednesday, January 16, 2019 8:08 AM