Northwind Traders
northwindtraders.onmicrosoft.com
Changes in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log that are worth confirming with the client: domain sign-in (federation) changes, new app secrets and certificates, admin roles granted, and Conditional Access policies deleted or switched off. Failed attempts are left out.
| When (UTC) | Change | By | Target | Detail |
|---|---|---|---|---|
| 9 Oct 2026, 16:00 high | Set domain authentication | mallory.price@northwindtraders.example | northwindtraders.example | |
Why it matters: Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone | ||||
| 11 Oct 2026, 16:00 medium | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| 10 Oct 2026, 16:00 medium | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| 10 Oct 2026, 04:00 medium | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator |
Why it matters: Admin role granted | ||||
| 9 Oct 2026, 04:00 medium | Add eligible member to role in PIM completed (permanent) | admin@northwindtraders.example | ann.patel@northwindtraders.example | Exchange Administrator |
Why it matters: Admin role granted | ||||
| 7 Oct 2026, 04:00 medium | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| 5 Oct 2026, 16:00 medium | Delete conditional access policy | admin@northwindtraders.example | Block risky countries | |
Why it matters: Conditional Access policy deleted | ||||
| 30 Sep 2026, 04:00 medium | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| 1 Sep 2026, 04:00 medium | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| 9 Aug 2026, 04:00 medium | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator |
Why it matters: Admin role granted | ||||
Every admin role, Conditional Access, policy, app, domain and account change in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log, newest first.
Change: Add eligible member to role in PIM completed (permanent)RemoveWhen (UTC): older than 90 daysRemove
Clear filters
No rows match these filters. Show all 22
Everyone (and every app) that made one of the changes above, most active first.
| Who | Type | Changes | Last change (UTC) |
|---|---|---|---|
| admin@northwindtraders.example | User | 18 | 10 Oct 2026, 16:00 |
| mallory.price@northwindtraders.example | User | 2 | 11 Oct 2026, 04:00 |
| Contoso Automation | App | 1 | 11 Oct 2026, 16:00 |
| Partner Center | App | 1 | 1 Oct 2026, 04:00 |
Data from Admin activity ().