Northwind Traders
northwindtraders.onmicrosoft.com
Changes in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log that are worth confirming with the client: domain sign-in (federation) changes, new app secrets and certificates, admin roles granted, and Conditional Access policies deleted or switched off. Failed attempts are left out.
| Change | By | Target | Detail | Why it matters |
|---|---|---|---|---|
| Set domain authentication high | mallory.price@ | northwindtraders.example | Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone | |
| Add service principal credentials medium | Contoso Automation | Mail Sync Pro | Credential added | New secret or certificate: whoever holds it can sign in as the app |
| Update application – Certificates and secrets management medium | admin@ | Payroll Sync | Added certificate | New secret or certificate: whoever holds it can sign in as the app |
| Add member to role medium | admin@ | robert.hughes@ | Global Administrator | Admin role granted |
| Add eligible member to role in PIM completed (permanent) medium | admin@ | ann.patel@ | Exchange Administrator | Admin role granted |
| Update conditional access policy medium | admin@ | Require MFA for all users | On → Off | Conditional Access policy no longer enforced |
| Delete conditional access policy medium | admin@ | Block risky countries | Conditional Access policy deleted | |
| Update application – Certificates and secrets management medium | admin@ | Payroll Sync | Added certificate | New secret or certificate: whoever holds it can sign in as the app |
| Update conditional access policy medium | admin@ | Require MFA for all users | On → Off | Conditional Access policy no longer enforced |
| Add member to role medium | admin@ | robert.hughes@ | Global Administrator | Admin role granted |
Every admin role, Conditional Access, policy, app, domain and account change in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log, newest first.
Everyone (and every app) that made one of the changes above, most active first.
| Who | Type | Changes | Last change (UTC) |
|---|---|---|---|
| admin@ | User | 18 | 10 Oct 2026, 18:36 |
| mallory.price@ | User | 2 | 11 Oct 2026, 06:36 |
| Contoso Automation | App | 1 | 11 Oct 2026, 18:36 |
| Partner Center | App | 1 | 1 Oct 2026, 06:36 |
Data from Admin activity ().