Fabrikam Dental Group
fabrikam.onmicrosoft.com
Changes in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log that are worth confirming with the client: domain sign-in (federation) changes, new app secrets and certificates, admin roles granted, and Conditional Access policies deleted or switched off. Failed attempts are left out.
| Change | By | Target | Detail | Why it matters |
|---|---|---|---|---|
| Set domain authentication high | mallory.quinn@ | fabrikam.example | Changes how users of a domain sign in; a rogue federation lets someone sign in as anyone | |
| Add service principal credentials medium | Contoso Automation | Mail Sync Pro | Credential added | New secret or certificate: whoever holds it can sign in as the app |
| Update application – Certificates and secrets management medium | admin@fabrikam.example | Payroll Sync | Added certificate | New secret or certificate: whoever holds it can sign in as the app |
| Add member to role medium | admin@fabrikam.example | ben.okafor@fabrikam.example | Global Administrator | Admin role granted |
| Add eligible member to role in PIM completed (permanent) medium | admin@fabrikam.example | anna.kowalski@ | Exchange Administrator | Admin role granted |
| Update conditional access policy medium | admin@fabrikam.example | Require MFA for all users | On → Off | Conditional Access policy no longer enforced |
| Delete conditional access policy medium | admin@fabrikam.example | Block risky countries | Conditional Access policy deleted | |
| Update application – Certificates and secrets management medium | admin@fabrikam.example | Payroll Sync | Added certificate | New secret or certificate: whoever holds it can sign in as the app |
| Update conditional access policy medium | admin@fabrikam.example | Require MFA for all users | On → Off | Conditional Access policy no longer enforced |
| Add member to role medium | admin@fabrikam.example | ben.okafor@fabrikam.example | Global Administrator | Admin role granted |
Every admin role, Conditional Access, policy, app, domain and account change in the 120 days since 14 Jun 2026, when Office Sentry started keeping this tenant's audit log, newest first.
| When (UTC) | Change | By | Target | Detail | Result | IP address |
|---|---|---|---|---|---|---|
| 11 Oct 2026, 06:36 | Add member to role | mallory.quinn@ | mallory.quinn@ | Global Administrator | Failed: Insufficient privileges | 203.0.113.9 |
| 9 Oct 2026, 18:36 high | Set domain authentication | mallory.quinn@ | fabrikam.example | Succeeded | 203.0.113.9 |
Everyone (and every app) that made one of the changes above, most active first.
| Who | Type | Changes | Last change (UTC) |
|---|---|---|---|
| admin@fabrikam.example | User | 18 | 10 Oct 2026, 18:36 |
| mallory.quinn@ | User | 2 | 11 Oct 2026, 06:36 |
| Contoso Automation | App | 1 | 11 Oct 2026, 18:36 |
| Partner Center | App | 1 | 1 Oct 2026, 06:36 |
Data from Admin activity ().