LOG-05: Admin Activity Anomaly Detection

LOG-05 is a security control that compromised admin accounts often exhibit unusual patterns: signing in from new locations, performing bulk operations, or working at unusual hours. detecting these anomalies enables early response to account compromise. It requires that unusual admin behaviors trigger alerts and new sign-in locations for admins are flagged, bulk operations by admins are monitored, off-hours admin activity is tracked.

Compromised admin accounts often exhibit unusual patterns: signing in from new locations, performing bulk operations, or working at unusual hours. Detecting these anomalies enables early response to account compromise.

LOG-05 requires manual implementation. Requires Identity Protection or SIEM with correlation rules

This control requires Azure AD Premium P2 (included in Microsoft 365 E5) or standalone P2.

LOG-05 is included in the Enhanced Security baseline (Level 2). This level adds stricter controls for security-conscious organizations.