Reviewing and monitoring Azure AD audit logs

In the previous section, we discussed sign-in logs and the information that they provide in terms of user and application sign-in activity. This section will discuss Azure AD audit logs and the information that they provide for reviewing and monitoring compliance.

Azure AD reports provide information that you will need to monitor and determine what is taking place within your environment and how it is doing. Azure AD audit logs provide information and records that pertain to activities for compliance.

The following steps cover how to access the audit reports and review the information:

1. Within portal.azure.com, navigate to Azure Active Directory and select Audit logs under the Monitoring section of the menu:

Figure 14.13 – Audit logs

2. View the default view that lists the following information: the data and time of the occurrence, the service that logged the occurrence, the category and...