This field matches Operation property in the Office 365 Audit log. |
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
4 |
On the Info tab, enter a name and description for the search. |
5 |
NOTE: You can use Add with Events | Subsystem | Azure Active Directory to select an existing event from the database and use its properties as a filter for a new search. |
6 |
Select All Events. |
4 |
Select the Layout tab and choose the Azure Active Directory information to include. |
5 |
Click OK to save your selection and close the dialog. |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
4 |
On the Info tab, enter a name and description for the search. |
5 |
6 |
Group by the Facility column. |
• |
To add all events within a facility, select the required Azure Active Directory facility, click Add | Add All Events in Facility, and click OK. |
• |
7 |
Select the Layout tab and choose the Azure Active Directory information to include. |
2 |
3 |
Click New to enable the Search Properties tabs across the bottom of the Searches page. |
5 |
NOTE: You can use Add with Events | Subsystem | Azure Active Directory to select an existing event from the database and use its properties as a filter for a new search. |
6 |
Select Selected Events to configure the search. |
• |
Select the Category filter to specify the event category to include in the search. Select a comparison operator (Like or Not like) and enter a category name. For example, if you are interested only in activities related to self-service password resets, you would choose the “Self-service Password Management” category. |
• |
Select the Activity Type filter to specify the activity to include in the search. Select a comparison operator (Like or Not like) and enter an activity type. For example, to only show user related activities you would select “User” as the activity type. |
• |
Select the Activity Name filter to specify the activity to include in the search. (For sign-in risk events, this will show the detected activity that occurred on the risk event.) Select a comparison operator (Like or Not like) and enter an activity name (character string and the * wildcard character). For example: Like *delete* will search for events where Activity contains ‘delete’. For a list of all available activities, see the Microsoft article “Audit activity reports in the Azure Active Directory portal”. |
• |
Select the Activity Details filter to include activity details in the search. (For sign-in risk events use the status of the risk event, such as Resolved). Select a comparison operator (Like or Not like) and enter a full or partial string (character string and the * wildcard character). For example, the 'Self-serve password reset flow activity progress' activity provides several different details including: User started the mobile SMS verification option, User started the e-mail verification option, or User successfully reset password. You can leave this filter blank to return events for all activities or narrow the search based on the activity details. |
• |
Select the Target filter to specify the target (primary and secondary targets) to include in the search. (For sign-in risk events, the field searches for the risk event type such as Sign-in from anonymous IP address). Select a comparison operator (Like or Not like) and enter a full or partial name (character string and the * wildcard character). The Target filter searches across the following properties: Object Name (Cloud Target Name), Target Display Name, On-Premises Target, Subject Name, Subject Display Name, and On-Premises Subject. |
7 |
Click Add to add the expression to the selection list. |
9 |
Select the Layout tab and choose the Azure Active Directory information to include. |
© ALL RIGHTS RESERVED. Feedback Términos de uso Privacidad Cookie Preference Center