Northwind Traders
northwindtraders.onmicrosoft.com
Changes in the 120 days since 13 Jun 2026, when Office Sentry started keeping this tenant's audit log that are worth confirming with the client: domain sign-in (federation) changes, new app secrets and certificates, admin roles granted, and Conditional Access policies deleted or switched off. Failed attempts are left out.
Change: Add eligible member to role in PIM completed (permanent)RemoveWhen (UTC): older than 30 daysRemove
Clear filters
No rows match these filters. Show all 10
Every admin role, Conditional Access, policy, app, domain and account change in the 120 days since 13 Jun 2026, when Office Sentry started keeping this tenant's audit log, newest first.
| When (UTC) | Area | Change | By | Target | Detail | Result | IP address |
|---|---|---|---|---|---|---|---|
| 11 Oct 2026, 08:31 medium | Apps | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added | Succeeded | |
| 10 Oct 2026, 20:31 | Admin roles | Add member to role | mallory.price@northwindtraders.example | mallory.price@northwindtraders.example | Global Administrator | Failed: Insufficient privileges | 203.0.113.9 |
| 10 Oct 2026, 08:31 medium | Apps | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate | Succeeded | 203.0.113.40 |
| 9 Oct 2026, 20:31 medium | Admin roles | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator | Succeeded | 203.0.113.40 |
| 9 Oct 2026, 08:31 high | Domains | Set domain authentication | mallory.price@northwindtraders.example | northwindtraders.example | Succeeded | 203.0.113.9 | |
| 8 Oct 2026, 20:31 medium | Admin roles | Add eligible member to role in PIM completed (permanent) | admin@northwindtraders.example | ann.patel@northwindtraders.example | Exchange Administrator | Succeeded | 203.0.113.40 |
| 8 Oct 2026, 08:31 | Accounts | Reset user password | admin@northwindtraders.example | ann.patel@northwindtraders.example | Succeeded | 203.0.113.40 | |
| 7 Oct 2026, 20:31 | Admin roles | Remove member from role | admin@northwindtraders.example | old.admin@northwindtraders.example | Global Administrator | Succeeded | 203.0.113.40 |
| 7 Oct 2026, 08:31 | Accounts | Admin registered security info | admin@northwindtraders.example | ann.patel@northwindtraders.example | Succeeded | 203.0.113.40 | |
| 6 Oct 2026, 20:31 medium | Conditional Access | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off | Succeeded | 203.0.113.40 |
| 5 Oct 2026, 20:31 | Conditional Access | Add conditional access policy | admin@northwindtraders.example | Block legacy authentication | On | Succeeded | 203.0.113.40 |
| 5 Oct 2026, 08:31 medium | Conditional Access | Delete conditional access policy | admin@northwindtraders.example | Block risky countries | Succeeded | 203.0.113.40 | |
| 3 Oct 2026, 20:31 | Apps | Update application – Certificates and secrets management | admin@northwindtraders.example | Old Integration | Removed secret | Succeeded | 203.0.113.40 |
| 2 Oct 2026, 20:31 | Apps | Consent to application | admin@northwindtraders.example | Mail Sync Pro | Admin consent for everyone: Mail.Read User.Read | Succeeded | 203.0.113.40 |
| 2 Oct 2026, 18:07 | Apps | Add app role assignment to service principal | admin@northwindtraders.example | Mail Sync Pro | Mail.ReadWrite on Microsoft Graph | Succeeded | 203.0.113.40 |
| 1 Oct 2026, 20:31 | Accounts | Delete user | admin@northwindtraders.example | leaver0@northwindtraders.example, leaver1@northwindtraders.example, leaver2@northwindtraders.example, leaver3@northwindtraders.example, leaver4@northwindtraders.example and 2 more | Succeeded | 203.0.113.40 | |
| 30 Sep 2026, 20:31 | Partners | Add partner to company | Partner Center | Contoso IT Services | Succeeded | ||
| 29 Sep 2026, 20:31 medium | Apps | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate | Succeeded | 203.0.113.40 |
| 29 Sep 2026, 20:31 | Domains | Verify domain | admin@northwindtraders.example | new.northwindtraders.example | Succeeded | 203.0.113.40 | |
| 31 Aug 2026, 20:31 medium | Conditional Access | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off | Succeeded | 203.0.113.40 |
| 8 Aug 2026, 20:31 medium | Admin roles | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator | Succeeded | 203.0.113.40 |
| 13 Jul 2026, 20:31 | Conditional Access | Add conditional access policy | admin@northwindtraders.example | Block legacy authentication | On | Succeeded | 203.0.113.40 |
Everyone (and every app) that made one of the changes above, most active first.
| Who | Type | Changes | Last change (UTC) |
|---|---|---|---|
| admin@northwindtraders.example | User | 18 | 10 Oct 2026, 08:31 |
| mallory.price@northwindtraders.example | User | 2 | 10 Oct 2026, 20:31 |
| Contoso Automation | App | 1 | 11 Oct 2026, 08:31 |
| Partner Center | App | 1 | 30 Sep 2026, 20:31 |
Data from Admin activity ().