All clients
Compare any report across every client you look after.
Changes in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log that are worth confirming with the client: domain sign-in (federation) changes, new app secrets and certificates, admin roles granted, and Conditional Access policies deleted or switched off. Failed attempts are left out.
| Client | Change | By | Target | Detail |
|---|---|---|---|---|
| Contoso Legal LLP high | Set domain authentication | mallory.hart@contoso.example | contoso.example | |
Why it matters: Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone | ||||
| Contoso Legal LLP medium | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Contoso Legal LLP medium | Update application – Certificates and secrets management | admin@contoso.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Contoso Legal LLP medium | Add member to role | admin@contoso.example | bobby.marsh@contoso.example | Global Administrator |
Why it matters: Admin role granted | ||||
| Contoso Legal LLP medium | Add eligible member to role in PIM completed (permanent) | admin@contoso.example | annabel.fraser@ | Exchange Administrator |
Why it matters: Admin role granted | ||||
| Contoso Legal LLP medium | Update conditional access policy | admin@contoso.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| Contoso Legal LLP medium | Delete conditional access policy | admin@contoso.example | Block risky countries | |
Why it matters: Conditional Access policy deleted | ||||
| Contoso Legal LLP medium | Update application – Certificates and secrets management | admin@contoso.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Contoso Legal LLP medium | Update conditional access policy | admin@contoso.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| Contoso Legal LLP medium | Add member to role | admin@contoso.example | bobby.marsh@contoso.example | Global Administrator |
Why it matters: Admin role granted | ||||
| Fabrikam Dental Group high | Set domain authentication | mallory.quinn@ | fabrikam.example | |
Why it matters: Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone | ||||
| Fabrikam Dental Group medium | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Fabrikam Dental Group medium | Update application – Certificates and secrets management | admin@fabrikam.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Fabrikam Dental Group medium | Add member to role | admin@fabrikam.example | ben.okafor@fabrikam.example | Global Administrator |
Why it matters: Admin role granted | ||||
| Fabrikam Dental Group medium | Add eligible member to role in PIM completed (permanent) | admin@fabrikam.example | anna.kowalski@ | Exchange Administrator |
Why it matters: Admin role granted | ||||
| Fabrikam Dental Group medium | Update conditional access policy | admin@fabrikam.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| Fabrikam Dental Group medium | Delete conditional access policy | admin@fabrikam.example | Block risky countries | |
Why it matters: Conditional Access policy deleted | ||||
| Fabrikam Dental Group medium | Update application – Certificates and secrets management | admin@fabrikam.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Fabrikam Dental Group medium | Update conditional access policy | admin@fabrikam.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| Fabrikam Dental Group medium | Add member to role | admin@fabrikam.example | ben.okafor@fabrikam.example | Global Administrator |
Why it matters: Admin role granted | ||||
| Northwind Traders high | Set domain authentication | mallory.price@ | northwindtraders.example | |
Why it matters: Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone | ||||
| Northwind Traders medium | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Northwind Traders medium | Update application – Certificates and secrets management | admin@ | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Northwind Traders medium | Add member to role | admin@ | robert.hughes@ | Global Administrator |
Why it matters: Admin role granted | ||||
| Northwind Traders medium | Add eligible member to role in PIM completed (permanent) | admin@ | ann.patel@ | Exchange Administrator |
Why it matters: Admin role granted | ||||
| Northwind Traders medium | Update conditional access policy | admin@ | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| Northwind Traders medium | Delete conditional access policy | admin@ | Block risky countries | |
Why it matters: Conditional Access policy deleted | ||||
| Northwind Traders medium | Update application – Certificates and secrets management | admin@ | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| Northwind Traders medium | Update conditional access policy | admin@ | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| Northwind Traders medium | Add member to role | admin@ | robert.hughes@ | Global Administrator |
Why it matters: Admin role granted | ||||
Built from each client's latest collection with the same report as the client's own page. Select a client's name to open its report.