Login to Exchange Online Protection and Security & Compliance Center PowerShell Module. Let’s create a new alert for any time someone creates, modifies or removes a transport rule. Once you create an Activity Alert will you then be able to see the management area in the portal. To get to the management portal you will need to create an Activity Alert first via PowerShell. Manage Activity Alerts section is not listed at first. Login to Office 365 admin portal and browse to Security & Compliance Center. This is a great way to create new Activity Alerts of changes to settings in your tenant. The “New-TransportRule” entry in the audit log.Īny executable command in Office 365 logged in the audit log can have an Activity Alert created. Results will show under the Activity section. In the Users section put in the name of your admin account, adjust the date to today and then click Search. Then go to Search & Investigation and Audit Log Search. After the transport rule is in place, you can go back to Security & Compliance Center. If you are not familiar with creating a transport rule you can learn about it here. I’d like for you to create a basic transport rule in your Exchange Admin Portal for testing purposes. In the example below, we will be testing with Transport rules. – UserId (whom the alert is being triggered against, ie. – Notifyuser (email address to send the alert) The basics of what we need are the following: Also, if you do not specify a “-userid” parameter, the alert will apply to all users in your tenant. This will help you in labeling the alerts. Take note in the article of the section for “-recordtype”. Commandsįor a list of Activity Alert parameter sets, you can review the following article here. Yet they could be worth alerting on if you have a large complex environment with hundreds of rules in place. Transport rules aren’t something you’re creating and modifying every day. They could then send your email to external email addresses. A compromised Admin Account could create a new transport rule without your knowledge. This is very useful if Global Admins across the globe are making changes that you are not aware of. We will walk through an example of Global Admins creating Transport rules. Execute the following: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true Creating Activity Alerts

If you would like to enable via PowerShell you can do so with the following command.Ĭonnect to Exchange Online Protection and the Security & Compliance Center PowerShell Module. A message will display saying the audit log is being prepared and you can run a search in a few hours. Click on Start Recording user and admin activities. If Auditing is not enabled for your tenant yet let’s enable it now. Go to Search & Investigation then Audit Log Search. Login to the admin portal and go to Security & Compliance. Ensure Auditing is in enabled in your tenant. How to set up Activity Alertsįirst, you’ll need to turn on Auditing and then create a test Activity Alert. Here’s an article showing breached Global Admin accounts for sale on the dark web. If you do not have auditing enabled then it will be hard to figure out what, if anything, changed in your tenant. Global Administrator accounts can get compromised. They can alert you to services or users in your tenant based on some criteria of attributes in the audit log. Creating Activity Alerts is a great way to inform you of changes made throughout your tenant. As an Office 365 Global Administrator, shouldn’t you know what changes are being made? Searching audit logs is not an ideal way of spending your time, not when you can automate alerts in Office 365 instead.Įnter Activity Alerts. Do you have more than five Global or Service Admins in your tenant? Do you know what changes are being made in your tenant daily across your services? Having too many Admins can create chaos between departments if communication is lacking.

Office 365 audit admin activity