LOG-05HighEnhanced Security
Admin Activity Anomaly Detection
Logging & Visibility control for Microsoft 365 and Entra ID
Why This Control Matters
Compromised admin accounts often exhibit unusual patterns: signing in from new locations, performing bulk operations, or working at unusual hours. Detecting these anomalies enables early response to account compromise.
Expected State
When this control is compliant, your tenant should meet these criteria:
- 1Unusual admin behaviors trigger alerts
- 2New sign-in locations for admins are flagged
- 3Bulk operations by admins are monitored
- 4Off-hours admin activity is tracked
Enforcement
Default Mode
Advisory
Alerts on deviations but does not make changes
Auto-Remediation
Manual Only
Requires Identity Protection or SIEM with correlation rules
Ready to implement this control?
TrueConfig continuously monitors your Microsoft 365 tenant for compliance with this and 50+ other security controls.