8 In-built Microsoft Entra Reports that Admins Should Monitor Weekly!

Microsoft Entra ID is a cloud-based platform that brings together the best of Microsoft’s identity solutions, including Azure Active Directory (Azure AD), Microsoft Entra Permissions Management, Microsoft Entra Identity Governance, and more. With MS Entra, access control and security aren’t just buzzwords; they’re the security guardians of your Microsoft 365 environment! 🚀

🤔Why did I say this, and what does it encompass? It has a lot to offer! It includes a comprehensive set of Microsoft 365 security settings, an extensive library of built-in reports, a workspace for Microsoft 365 usage & analytics tasks, and much more! 😌Whether you’re a global enterprise or a budding startup, Entra ID opens its doors to welcome you with open arms, tailoring its services to fit your unique needs.

Therefore, to assist you in enhancing your organization’s security, we’ve curated a list of 7 essential MS Entra (Azure AD) reports that every admin should monitor diligently on a weekly basis. So, let’s dive right in and see what’s in the bag without delay!

8 (Azure AD) Entra ID Reports for Microsoft 365 Admins:

Your organization’s security deserves nothing less!

Yeah, of course! As technology continues to advance, so do the threats that come with it. Therefore, it’s vital to stay vigilant & avoid potential threats against your organization. In this regard, the following 7 handpicked Azure portal reports can be your ultimate defense, helping you to stay one step ahead and secure your Microsoft 365 environment effectively! Make use of the reports and strengthen your organization.

Monitor Azure AD sign-in logs in Microsoft 365
Investigate every risky log-in attempt within your Microsoft 365
Review app permissions & consents in Microsoft 365
Monitor Conditional Access policy changes in MS Entra
Find application activities in Microsoft 365
Check which users have registered for Azure MFA in Microsoft 365
MFA registration & reset event reports
Self-service password reset reports in Azure AD

Want a quick rundown of all the reports without diving into loads of pages? Well, guess what? We’ve put together a fantastic cheat sheet that’s got you covered. Just flip through whenever you need it and get things set up effortlessly! 🚀

Download Cheat Sheet: In-built Microsoft Entra reports.

Tracking your organization user’s sign-in is something to be monitored very essentially! By monitoring who is signing in, when they are signing in, and from where they are signing in, admins can quickly spot any suspicious behavior right off the bat. And it’s the way to make sure that only the right people get access!

Imagine if your house had a doorbell that recorded everyone who rang it – you’d know who was visiting, right? Well, monitoring user sign-ins is a bit like that, but for your online accounts. 💯So, grab the Microsoft 365 user sign-in activity logs and be watchful of every activity!

More info: https://blog.admindroid.com/monitoring-azure-ad-sign-in-logs-and-risky-sign-in-activities/

Report link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/SignInEventsV3Blade/timeRangeType
/last24hours/showApplicationSignIns/

2. Investigate Every Risky Log-in Attempt Within your Microsoft 365:

Keeping your organization’s security on lock means paying close attention to risky sign-ins in Microsoft 365. Because such sign-ins are a major security threat to organizations! ⚠️

They can be caused by various factors, such as stolen passwords, compromised accounts, and brute-force attacks.

When a risky sign-in occurs, it’s a sign saying, “Something’s not right here.”❌ Therefore, monitoring Microsoft 365 risky sign-ins & users is essential for admins to protect their organization from severe threats. So, keep your defenses sharp and your responses swift, and let the monitoring of risky sign-ins be your shield against malicious forces!

More info: https://blog.admindroid.com/secure-your-office-365-tenant-from-risky-log-in-attempts/

Report link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/SecurityMenuBlade/~/RiskySignIns/
menuId/RiskyUsers/fromNav/

3. Review App Permissions & Consents in Microsoft 365:

From file management to scheduling, applications seamlessly handle it all once we grant them the necessary permissions. However, it’s crucial for admins to understand that not all apps have noble intentions! 🤧Some may tactfully request extensive permissions, potentially compromising sensitive organizational data! So, this is why admins should keenly review app permissions in Microsoft 365.

It’s not just about enhancing productivity; it’s about safeguarding your organization’s invaluable information. Stay in control, protect your data, and let the right apps work their magic!

More info: https://blog.admindroid.com/review-app-permissions-consents-in-microsoft-365/

Report link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/
UserSettings

4. Monitor Conditional Access Policy Changes in MS Entra:

While the ‘Conditional Access policy’ tool can be a powerful asset, even the slightest misconfiguration can lead to an organizational lockout or affect specific user groups, a scenario no one wishes to encounter! 😫

So, that’s why it’s imperative for admins to closely monitor changes in conditional access policies within Microsoft 365. Keep a vigilant eye, maintain control, and let the policies work expectedly!

More info: https://blog.admindroid.com/an-admins-complete-guide-to-monitor-conditional-access-policy-changes/

Report link: https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/
~/signInLogs/fromNav/Identity

5. Find Application Activities in Microsoft 365:

This application activity report in Azure AD is a goldmine of information for admins! 💡 Admins can export this report and find the sign-in activities of all the applications currently in use. Moreover, it provides answers to questions such as:

What are the top-used applications?
Which applications have a high successful sign-in rate?
On the flip side, find out which apps are experiencing errors, registering the most failed sign-in attempts, etc.

In essence, Microsoft 365’s application activity reports can be used to improve security, troubleshoot problems, and deploy and manage applications more efficiently.

More info: https://blog.admindroid.com/azure-ad-application-activity-report-analysis/

Report link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/UsageAndInsightsMenuBlade/
~/Azure%20AD%20application%20activity

6. Check Which Users Have Registered for Azure MFA in Microsoft 365:

You know, with all these MFA attacks on the rise, Microsoft is really stepping up their game when it comes to fine-tuning MFA authentication methods. 👏These reports are the real deal, so let’s explore what’s behind these reports!

The MFA user registration details report offers a comprehensive overview of users capable of Azure MFA, passwordless Authentication, and self-service password reset. Moreover, it also allows you to zoom into individual MFA registration profiles of users.

More info: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-methods-activity#user-registration-details

Report link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/
~/UserRegistrationDetails/fromNav/Identity

7. MFA Registration & Reset Event Reports:

This report is not just a list; it’s your early warning system against potential cyber threats! 😌Yeah, let me break it down and share why it matters: Hackers often tie MFA to a device they control after compromising user accounts.

Now, in the event of an account breach, this report becomes your detective and lets you scrutinize MFA methods, dates, and timestamps for any suspicious registrations or resets. Admins can download this report for the selective period and examine if any registrations and reset were made.

So, if you’re serious about safeguarding your user accounts, check out this report periodically!

More info: https://blog.admindroid.com/inbuilt-reports-on-azure-mfa-registration-and-reset-events/

Report link: https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/
~/RegistrationAndResetLogs/fromNav/Identity

8. Self-service Password Reset Reports in Azure AD:

Self-service password reset (SSPR) is a feature in Entra ID that allows users to reset their own passwords without having to contact the help desk! 📞This is a very convenient & efficient way for users to regain access to their accounts. But here’s the check; sometimes it could be a security risk too! 🤧

That’s why it’s important for admins to monitor self-service password reset reports. These reports show the number of times users have reset their passwords as well as the reasons for the resets. By monitoring SSPR reports, admins can identify users who are resetting their passwords frequently, which could be a sign of a security problem. Therefore, monitor these reports to strengthen Microsoft 365 password policy within your organization.

More info: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-reporting

Report link: https://portal.azure.com/#view/Microsoft_AAD_IAM/PasswordResetMenuBlade/~/Audit

The Microsoft Entra ID (Azure AD) reports are boundless, and we’re just scratching the surface! 😯There’s more – a whole array of in-built reports hidden within your Microsoft Entra admin center. 📊

So, if you’re serious about keeping your organization’s defenses rock-solid in the face of attackers, it’s time to check out the document below. Here, you’ll find everything you need to know about your users, Microsoft 365 groups, MFA reports, user sign-in activities, and more, from top to bottom! 💯

More info: https://blog.admindroid.com/10-built-in-azure-ad-reports-to-spot-anomalous-user-activities/

In conclusion, as we’ve explored these 7 meticulously curated Microsoft Entra reports, it’s abundantly clear that they are more than just reports – they are the guards helping you to secure your organization data. 🚀

And remember, security isn’t a static destination; it’s a dynamic journey. To stay ahead in the ever-changing cybersecurity game, make it a habit to regularly review Microsoft 365 admin center reports, native Exchange Online reports, in-built SharePoint reports, and every report available within your environment. By doing so, you not only safeguard your organization against emerging threats but also position yourself as a guardian of its digital fortress.

Here’s to a safer, more secure digital tomorrow! 🛡️