Change Auditor 7.1.1

Table 2. Azure Active Directory User events
Event	This event is triggered when....
User AlternativeSecurityId property changed	Created when a user’s alternate security ID is changed as part of the Azure Active Directory external account workflow.
User MSExchRemoteRecipientType property changed	Created when mailbox type is changed. For example, an on-premises mailbox was migrated to Exchange Online or archive mailbox was added.
User LicenseAssignmentDetail property changed	Created when the license detail assigned to a user is changed.
User UserPrincipalName property changed	Created when the UPN for a user account is changed.
User UserType property changed	Created when the user type is changed. The available type includes member, guest, or viral.
User UserStateChangedOn property changed	Created when the timestamp of the last change to the UserState is changed as part of the Azure Active Directory external account workflow.
User UserState property changed	Created when the user state is changed as part of the Azure Active Directory external account workflow. (PendingApproval/PendingAcceptance/Accepted/ PendingVerification)
User StsRefreshTokensValidFrom property changed	Created when a user's StsRefreshTokenValidFrom property is changed. For example, when a user’s authorization token should be invalidated.
User StrongAuthenticationPhoneAppDetail property changed .	Created when a user’s phone application used for multi-factor authentication and password reset verification have been changed
User ProxyAddresses property changed	Created when one of the user proxy addresses is changed, added, or removed.
User PreferredDataLocation property changed	Created when the preferred location for the user data is changed.

Additional Office 365 and Azure Active Directory event details

The event details pane contains the following additional information to help gain a better understanding of the activities taking place in Microsoft Office 365 Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory.

Table 3. Event details
Tab	Available information
Overview	Displays a high-level view of the activity that is generated for each event. You can quickly see when the event occurred, who made the change, what changed, where the change originated, the activity as defined by the Azure Active Directory reporting APIs schema, the target, target synchronization type, activity type, category, and action.
Target (Azure Active Directory events only)	Displays details on the property updates with the old and new value when available. It also displays information about multiple targets affected by a single event. For example, when a user added to a group, you can see both the user and the group as affected targets. When there are multiple targets, the target that best matches the activity type is displayed as the primary target in the Overview tab.
Details	Displays all available properties for a deeper analysis of the activity. It contains raw data from Azure Active Directory Reporting API.
Parameters (Exchange Online Administration events only)	Displays the parameters used to run the Office 365 Administrative command.