Northwind Traders
northwindtraders.onmicrosoft.com
Changes in the 120 days since 13 Jun 2026, when Office Sentry started keeping this tenant's audit log that are worth confirming with the client: domain sign-in (federation) changes, new app secrets and certificates, admin roles granted, and Conditional Access policies deleted or switched off. Failed attempts are left out.
| When (UTC) | Change | By | Target | Detail |
|---|---|---|---|---|
| 9 Oct 2026, 08:31 high | Set domain authentication | mallory.price@northwindtraders.example | northwindtraders.example | |
Why it matters: Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone | ||||
| 11 Oct 2026, 08:31 medium | Add service principal credentials | Contoso Automation | Mail Sync Pro | Credential added |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| 10 Oct 2026, 08:31 medium | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| 9 Oct 2026, 20:31 medium | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator |
Why it matters: Admin role granted | ||||
| 8 Oct 2026, 20:31 medium | Add eligible member to role in PIM completed (permanent) | admin@northwindtraders.example | ann.patel@northwindtraders.example | Exchange Administrator |
Why it matters: Admin role granted | ||||
| 6 Oct 2026, 20:31 medium | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| 5 Oct 2026, 08:31 medium | Delete conditional access policy | admin@northwindtraders.example | Block risky countries | |
Why it matters: Conditional Access policy deleted | ||||
| 29 Sep 2026, 20:31 medium | Update application – Certificates and secrets management | admin@northwindtraders.example | Payroll Sync | Added certificate |
Why it matters: New secret or certificate: whoever holds it can sign in as the app | ||||
| 31 Aug 2026, 20:31 medium | Update conditional access policy | admin@northwindtraders.example | Require MFA for all users | On → Off |
Why it matters: Conditional Access policy no longer enforced | ||||
| 8 Aug 2026, 20:31 medium | Add member to role | admin@northwindtraders.example | robert.hughes@northwindtraders.example | Global Administrator |
Why it matters: Admin role granted | ||||
Every admin role, Conditional Access, policy, app, domain and account change in the 120 days since 13 Jun 2026, when Office Sentry started keeping this tenant's audit log, newest first.
| When (UTC) | Area | Change | Target | Detail | Result | IP address |
|---|---|---|---|---|---|---|
| 11 Oct 2026, 08:31 medium | Apps | Add service principal credentials | Mail Sync Pro | Credential added | Succeeded | |
| 10 Oct 2026, 20:31 | Admin roles | Add member to role | mallory.price@northwindtraders.example | Global Administrator | Failed: Insufficient privileges | 203.0.113.9 |
| 10 Oct 2026, 08:31 medium | Apps | Update application – Certificates and secrets management | Payroll Sync | Added certificate | Succeeded | 203.0.113.40 |
| 9 Oct 2026, 20:31 medium | Admin roles | Add member to role | robert.hughes@northwindtraders.example | Global Administrator | Succeeded | 203.0.113.40 |
| 9 Oct 2026, 08:31 high | Domains | Set domain authentication | northwindtraders.example | Succeeded | 203.0.113.9 | |
| 8 Oct 2026, 20:31 medium | Admin roles | Add eligible member to role in PIM completed (permanent) | ann.patel@northwindtraders.example | Exchange Administrator | Succeeded | 203.0.113.40 |
| 8 Oct 2026, 08:31 | Accounts | Reset user password | ann.patel@northwindtraders.example | Succeeded | 203.0.113.40 | |
| 7 Oct 2026, 20:31 | Admin roles | Remove member from role | old.admin@northwindtraders.example | Global Administrator | Succeeded | 203.0.113.40 |
| 7 Oct 2026, 08:31 | Accounts | Admin registered security info | ann.patel@northwindtraders.example | Succeeded | 203.0.113.40 | |
| 6 Oct 2026, 20:31 medium | Conditional Access | Update conditional access policy | Require MFA for all users | On → Off | Succeeded | 203.0.113.40 |
| 5 Oct 2026, 20:31 | Conditional Access | Add conditional access policy | Block legacy authentication | On | Succeeded | 203.0.113.40 |
| 5 Oct 2026, 08:31 medium | Conditional Access | Delete conditional access policy | Block risky countries | Succeeded | 203.0.113.40 | |
| 3 Oct 2026, 20:31 | Apps | Update application – Certificates and secrets management | Old Integration | Removed secret | Succeeded | 203.0.113.40 |
| 2 Oct 2026, 20:31 | Apps | Consent to application | Mail Sync Pro | Admin consent for everyone: Mail.Read User.Read | Succeeded | 203.0.113.40 |
| 2 Oct 2026, 18:07 | Apps | Add app role assignment to service principal | Mail Sync Pro | Mail.ReadWrite on Microsoft Graph | Succeeded | 203.0.113.40 |
| 1 Oct 2026, 20:31 | Accounts | Delete user | leaver0@northwindtraders.example, leaver1@northwindtraders.example, leaver2@northwindtraders.example, leaver3@northwindtraders.example, leaver4@northwindtraders.example and 2 more | Succeeded | 203.0.113.40 | |
| 30 Sep 2026, 20:31 | Partners | Add partner to company | Contoso IT Services | Succeeded | ||
| 29 Sep 2026, 20:31 medium | Apps | Update application – Certificates and secrets management | Payroll Sync | Added certificate | Succeeded | 203.0.113.40 |
| 29 Sep 2026, 20:31 | Domains | Verify domain | new.northwindtraders.example | Succeeded | 203.0.113.40 | |
| 31 Aug 2026, 20:31 medium | Conditional Access | Update conditional access policy | Require MFA for all users | On → Off | Succeeded | 203.0.113.40 |
| 8 Aug 2026, 20:31 medium | Admin roles | Add member to role | robert.hughes@northwindtraders.example | Global Administrator | Succeeded | 203.0.113.40 |
| 13 Jul 2026, 20:31 | Conditional Access | Add conditional access policy | Block legacy authentication | On | Succeeded | 203.0.113.40 |
Everyone (and every app) that made one of the changes above, most active first.
| Who | Type | Changes | Last change (UTC) |
|---|---|---|---|
| admin@northwindtraders.example | User | 18 | 10 Oct 2026, 08:31 |
| mallory.price@northwindtraders.example | User | 2 | 10 Oct 2026, 20:31 |
| Contoso Automation | App | 1 | 11 Oct 2026, 08:31 |
| Partner Center | App | 1 | 30 Sep 2026, 20:31 |
Data from Admin activity ().