All clients
Compare any report across every client you look after.
Every admin role, Conditional Access, policy, app, domain and account change in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log, newest first.
| Client | When (UTC) | Area | Change | By | Target | Detail | IP address |
|---|---|---|---|---|---|---|---|
| Contoso Legal LLP medium | 11 Oct 2026, 16:00 | Apps | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added | |
| Contoso Legal LLP | 11 Oct 2026, 04:00 | Admin roles | Add member to role | mallory.hart@contoso.example | mallory.hart@contoso.example | Global Administrator | 203.0.113.9 |
| Contoso Legal LLP medium | 10 Oct 2026, 16:00 | Apps | Update application – Certificates and secrets management | admin@contoso.example | Payroll Sync | Added certificate | 203.0.113.40 |
| Contoso Legal LLP medium | 10 Oct 2026, 04:00 | Admin roles | Add member to role | admin@contoso.example | bobby.marsh@contoso.example | Global Administrator | 203.0.113.40 |
| Contoso Legal LLP high | 9 Oct 2026, 16:00 | Domains | Set domain authentication | mallory.hart@contoso.example | contoso.example | 203.0.113.9 | |
| Contoso Legal LLP medium | 9 Oct 2026, 04:00 | Admin roles | Add eligible member to role in PIM completed (permanent) | admin@contoso.example | annabel.fraser@contoso.example | Exchange Administrator | 203.0.113.40 |
| Contoso Legal LLP | 8 Oct 2026, 16:00 | Accounts | Reset user password | admin@contoso.example | annabel.fraser@contoso.example | 203.0.113.40 | |
| Contoso Legal LLP | 8 Oct 2026, 04:00 | Admin roles | Remove member from role | admin@contoso.example | old.admin@contoso.example | Global Administrator | 203.0.113.40 |
| Contoso Legal LLP | 7 Oct 2026, 16:00 | Accounts | Admin registered security info | admin@contoso.example | annabel.fraser@contoso.example | 203.0.113.40 | |
| Contoso Legal LLP medium | 7 Oct 2026, 04:00 | Conditional Access | Update conditional access policy | admin@contoso.example | Require MFA for all users | On → Off | 203.0.113.40 |
| Contoso Legal LLP | 6 Oct 2026, 04:00 | Conditional Access | Add conditional access policy | admin@contoso.example | Block legacy authentication | On | 203.0.113.40 |
| Contoso Legal LLP medium | 5 Oct 2026, 16:00 | Conditional Access | Delete conditional access policy | admin@contoso.example | Block risky countries | 203.0.113.40 | |
| Contoso Legal LLP | 4 Oct 2026, 04:00 | Apps | Update application – Certificates and secrets management | admin@contoso.example | Old Integration | Removed secret | 203.0.113.40 |
| Contoso Legal LLP | 3 Oct 2026, 04:00 | Apps | Consent to application | admin@contoso.example | Mail Sync Pro | Admin consent for everyone: Mail.Read User.Read | 203.0.113.40 |
| Contoso Legal LLP | 3 Oct 2026, 01:36 | Apps | Add app role assignment to service principal | admin@contoso.example | Mail Sync Pro | Mail.ReadWrite on Microsoft Graph | 203.0.113.40 |
| Contoso Legal LLP | 2 Oct 2026, 04:00 | Accounts | Delete user | admin@contoso.example | leaver0@contoso.example, leaver1@contoso.example, leaver2@contoso.example, leaver3@contoso.example, leaver4@contoso.example and 2 more | 203.0.113.40 | |
| Contoso Legal LLP | 1 Oct 2026, 04:00 | Partners | Add partner to company | Partner Center | Contoso IT Services | ||
| Contoso Legal LLP medium | 30 Sep 2026, 04:00 | Apps | Update application – Certificates and secrets management | admin@contoso.example | Payroll Sync | Added certificate | 203.0.113.40 |
| Contoso Legal LLP | 30 Sep 2026, 04:00 | Domains | Verify domain | admin@contoso.example | new.contoso.example | 203.0.113.40 | |
| Contoso Legal LLP medium | 1 Sep 2026, 04:00 | Conditional Access | Update conditional access policy | admin@contoso.example | Require MFA for all users | On → Off | 203.0.113.40 |
| Contoso Legal LLP medium | 9 Aug 2026, 04:00 | Admin roles | Add member to role | admin@contoso.example | bobby.marsh@contoso.example | Global Administrator | 203.0.113.40 |
| Contoso Legal LLP | 14 Jul 2026, 04:00 | Conditional Access | Add conditional access policy | admin@contoso.example | Block legacy authentication | On | 203.0.113.40 |
| Fabrikam Dental Group medium | 11 Oct 2026, 16:00 | Apps | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added | |
| Fabrikam Dental Group | 11 Oct 2026, 04:00 | Admin roles | Add member to role | mallory.quinn@fabrikam.example | mallory.quinn@fabrikam.example | Global Administrator | 203.0.113.9 |
| Fabrikam Dental Group medium | 10 Oct 2026, 16:00 | Apps | Update application – Certificates and secrets management | admin@fabrikam.example | Payroll Sync | Added certificate | 203.0.113.40 |
| Fabrikam Dental Group medium | 10 Oct 2026, 04:00 | Admin roles | Add member to role | admin@fabrikam.example | ben.okafor@fabrikam.example | Global Administrator | 203.0.113.40 |
| Fabrikam Dental Group high | 9 Oct 2026, 16:00 | Domains | Set domain authentication | mallory.quinn@fabrikam.example | fabrikam.example | 203.0.113.9 | |
| Fabrikam Dental Group medium | 9 Oct 2026, 04:00 | Admin roles | Add eligible member to role in PIM completed (permanent) | admin@fabrikam.example | anna.kowalski@fabrikam.example | Exchange Administrator | 203.0.113.40 |
| Fabrikam Dental Group | 8 Oct 2026, 16:00 | Accounts | Reset user password | admin@fabrikam.example | anna.kowalski@fabrikam.example | 203.0.113.40 | |
| Fabrikam Dental Group | 8 Oct 2026, 04:00 | Admin roles | Remove member from role | admin@fabrikam.example | old.admin@fabrikam.example | Global Administrator | 203.0.113.40 |
| Fabrikam Dental Group | 7 Oct 2026, 16:00 | Accounts | Admin registered security info | admin@fabrikam.example | anna.kowalski@fabrikam.example | 203.0.113.40 | |
| Fabrikam Dental Group medium | 7 Oct 2026, 04:00 | Conditional Access | Update conditional access policy | admin@fabrikam.example | Require MFA for all users | On → Off | 203.0.113.40 |
| Fabrikam Dental Group | 6 Oct 2026, 04:00 | Conditional Access | Add conditional access policy | admin@fabrikam.example | Block legacy authentication | On | 203.0.113.40 |
| Fabrikam Dental Group medium | 5 Oct 2026, 16:00 | Conditional Access | Delete conditional access policy | admin@fabrikam.example | Block risky countries | 203.0.113.40 | |
| Fabrikam Dental Group | 4 Oct 2026, 04:00 | Apps | Update application – Certificates and secrets management | admin@fabrikam.example | Old Integration | Removed secret | 203.0.113.40 |
| Fabrikam Dental Group | 3 Oct 2026, 04:00 | Apps | Consent to application | admin@fabrikam.example | Mail Sync Pro | Admin consent for everyone: Mail.Read User.Read | 203.0.113.40 |
| Fabrikam Dental Group | 3 Oct 2026, 01:36 | Apps | Add app role assignment to service principal | admin@fabrikam.example | Mail Sync Pro | Mail.ReadWrite on Microsoft Graph | 203.0.113.40 |
| Fabrikam Dental Group | 2 Oct 2026, 04:00 | Accounts | Delete user | admin@fabrikam.example | leaver0@fabrikam.example, leaver1@fabrikam.example, leaver2@fabrikam.example, leaver3@fabrikam.example, leaver4@fabrikam.example and 2 more | 203.0.113.40 | |
| Fabrikam Dental Group | 1 Oct 2026, 04:00 | Partners | Add partner to company | Partner Center | Contoso IT Services | ||
| Fabrikam Dental Group medium | 30 Sep 2026, 04:00 | Apps | Update application – Certificates and secrets management | admin@fabrikam.example | Payroll Sync | Added certificate | 203.0.113.40 |
| Fabrikam Dental Group | 30 Sep 2026, 04:00 | Domains | Verify domain | admin@fabrikam.example | new.fabrikam.example | 203.0.113.40 | |
| Fabrikam Dental Group medium | 1 Sep 2026, 04:00 | Conditional Access | Update conditional access policy | admin@fabrikam.example | Require MFA for all users | On → Off | 203.0.113.40 |
| Fabrikam Dental Group medium | 9 Aug 2026, 04:00 | Admin roles | Add member to role | admin@fabrikam.example | ben.okafor@fabrikam.example | Global Administrator | 203.0.113.40 |
| Fabrikam Dental Group | 14 Jul 2026, 04:00 | Conditional Access | Add conditional access policy | admin@fabrikam.example | Block legacy authentication | On | 203.0.113.40 |
| Northwind Traders medium | 11 Oct 2026, 16:00 | Apps | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added | |
| Northwind Traders | 11 Oct 2026, 04:00 | Admin roles | Add member to role | mallory.price@northwindtraders.example | mallory.price@northwindtraders.example | Global Administrator | 203.0.113.9 |
| Northwind Traders medium | 10 Oct 2026, 16:00 | Apps | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate | 203.0.113.40 |
| Northwind Traders medium | 10 Oct 2026, 04:00 | Admin roles | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator | 203.0.113.40 |
| Northwind Traders high | 9 Oct 2026, 16:00 | Domains | Set domain authentication | mallory.price@northwindtraders.example | northwindtraders.example | 203.0.113.9 | |
| Northwind Traders medium | 9 Oct 2026, 04:00 | Admin roles | Add eligible member to role in PIM completed (permanent) | admin@northwindtraders.example | ann.patel@northwindtraders.example | Exchange Administrator | 203.0.113.40 |
| Northwind Traders | 8 Oct 2026, 16:00 | Accounts | Reset user password | admin@northwindtraders.example | ann.patel@northwindtraders.example | 203.0.113.40 | |
| Northwind Traders | 8 Oct 2026, 04:00 | Admin roles | Remove member from role | admin@northwindtraders.example | old.admin@northwindtraders.example | Global Administrator | 203.0.113.40 |
| Northwind Traders | 7 Oct 2026, 16:00 | Accounts | Admin registered security info | admin@northwindtraders.example | ann.patel@northwindtraders.example | 203.0.113.40 | |
| Northwind Traders medium | 7 Oct 2026, 04:00 | Conditional Access | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off | 203.0.113.40 |
| Northwind Traders | 6 Oct 2026, 04:00 | Conditional Access | Add conditional access policy | admin@northwindtraders.example | Block legacy authentication | On | 203.0.113.40 |
| Northwind Traders medium | 5 Oct 2026, 16:00 | Conditional Access | Delete conditional access policy | admin@northwindtraders.example | Block risky countries | 203.0.113.40 | |
| Northwind Traders | 4 Oct 2026, 04:00 | Apps | Update application – Certificates and secrets management | admin@northwindtraders.example | Old Integration | Removed secret | 203.0.113.40 |
| Northwind Traders | 3 Oct 2026, 04:00 | Apps | Consent to application | admin@northwindtraders.example | Mail Sync Pro | Admin consent for everyone: Mail.Read User.Read | 203.0.113.40 |
| Northwind Traders | 3 Oct 2026, 01:36 | Apps | Add app role assignment to service principal | admin@northwindtraders.example | Mail Sync Pro | Mail.ReadWrite on Microsoft Graph | 203.0.113.40 |
| Northwind Traders | 2 Oct 2026, 04:00 | Accounts | Delete user | admin@northwindtraders.example | leaver0@northwindtraders.example, leaver1@northwindtraders.example, leaver2@northwindtraders.example, leaver3@northwindtraders.example, leaver4@northwindtraders.example and 2 more | 203.0.113.40 | |
| Northwind Traders | 1 Oct 2026, 04:00 | Partners | Add partner to company | Partner Center | Contoso IT Services | ||
| Northwind Traders medium | 30 Sep 2026, 04:00 | Apps | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate | 203.0.113.40 |
| Northwind Traders | 30 Sep 2026, 04:00 | Domains | Verify domain | admin@northwindtraders.example | new.northwindtraders.example | 203.0.113.40 | |
| Northwind Traders medium | 1 Sep 2026, 04:00 | Conditional Access | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off | 203.0.113.40 |
| Northwind Traders medium | 9 Aug 2026, 04:00 | Admin roles | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator | 203.0.113.40 |
| Northwind Traders | 14 Jul 2026, 04:00 | Conditional Access | Add conditional access policy | admin@northwindtraders.example | Block legacy authentication | On | 203.0.113.40 |
Built from each client's latest collection with the same report as the client's own page. Select a client's name to open its report.