Northwind Traders
northwindtraders.onmicrosoft.com
Changes in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log that are worth confirming with the client: domain sign-in (federation) changes, new app secrets and certificates, admin roles granted, and Conditional Access policies deleted or switched off. Failed attempts are left out.
| When (UTC) | Change | By | Target | Detail |
|---|---|---|---|---|
| 6 Oct 2026, 05:16 medium | Delete conditional access policy | admin@ | Block risky countries | |
Why it matters: Conditional Access policy deleted | ||||
Every admin role, Conditional Access, policy, app, domain and account change in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log, newest first.
| Change | By | Target | Detail | Result |
|---|---|---|---|---|
| Add service principal credentials medium | Contoso Automation | Mail Sync Pro | Credential added | Succeeded |
| Add member to role | mallory.price@ | mallory.price@ | Global Administrator | Failed: Insufficient privileges |
| Update application – Certificates and secrets management medium | admin@ | Payroll Sync | Added certificate | Succeeded |
| Add member to role medium | admin@ | robert.hughes@ | Global Administrator | Succeeded |
| Set domain authentication high | mallory.price@ | northwindtraders.example | Succeeded | |
| Add eligible member to role in PIM completed (permanent) medium | admin@ | ann.patel@ | Exchange Administrator | Succeeded |
| Reset user password | admin@ | ann.patel@ | Succeeded | |
| Remove member from role | admin@ | old.admin@ | Global Administrator | Succeeded |
| Admin registered security info | admin@ | ann.patel@ | Succeeded | |
| Update conditional access policy medium | admin@ | Require MFA for all users | On → Off | Succeeded |
| Add conditional access policy | admin@ | Block legacy authentication | On | Succeeded |
| Delete conditional access policy medium | admin@ | Block risky countries | Succeeded | |
| Update application – Certificates and secrets management | admin@ | Old Integration | Removed secret | Succeeded |
| Consent to application | admin@ | Mail Sync Pro | Admin consent for everyone: Mail.Read User.Read | Succeeded |
| Add app role assignment to service principal | admin@ | Mail Sync Pro | Mail.ReadWrite on Microsoft Graph | Succeeded |
| Delete user | admin@ | leaver0@ | Succeeded | |
| Add partner to company | Partner Center | Contoso IT Services | Succeeded | |
| Update application – Certificates and secrets management medium | admin@ | Payroll Sync | Added certificate | Succeeded |
| Verify domain | admin@ | new.northwindtraders.example | Succeeded | |
| Update conditional access policy medium | admin@ | Require MFA for all users | On → Off | Succeeded |
| Add member to role medium | admin@ | robert.hughes@ | Global Administrator | Succeeded |
| Add conditional access policy | admin@ | Block legacy authentication | On | Succeeded |
Everyone (and every app) that made one of the changes above, most active first.
| Who | Type | Changes | Last change (UTC) |
|---|---|---|---|
| admin@ | User | 18 | 11 Oct 2026, 05:16 |
| mallory.price@ | User | 2 | 11 Oct 2026, 17:16 |
| Contoso Automation | App | 1 | 12 Oct 2026, 05:16 |
| Partner Center | App | 1 | 1 Oct 2026, 17:16 |
Data from Admin activity ().