Tracking logon sessions in Office365 logsOffice365: mailbox catch-allpostfix relaying all mail through office365 problemsAdding alias to an Office 365 mailbox with dirsyncCan I customize the “Office365” link in Outlook for Office365?Office365 - cannot email DynamicDistributionGroupOffice365 Application AccountsDoes Office365 Compliance hold Outlook OWA ChatMessages?Unable to get migrate exchange mailboxes due to unknown status of MRS proxyOutlook + Office365 & VLAN issuesAzure AD with Office 365 users and a NAS share
Why A=2 and B=1 in the call signs for Spirit and Opportunity?
What weight should be given to writers groups critiques?
Is it possible to prohibit all prohibitable schools of magic with a single character?
Beginner looking to learn/master musical theory and instrumental ability. Where should I begin?
Why did the person in charge of a principality not just declare themself king?
How to let other coworkers know that I don't share my coworker's political views?
Manager questioning my time estimates for a project
Is there an actual reason behind the author's using the number four in "value meal number four"
How do I superimpose two math symbols?
Is there a standard name for this relation property : " aRb --> there is no c different from b such that aRc "?
Why haven't we yet tried accelerating a space station with people inside to a near light speed?
Time complexity of an algorithm: Is it important to state the base of the logarithm?
Freedom of Speech and Assembly in China
Is keeping the forking link on a true fork necessary (Github/GPL)?
“Quand même” to mean “anyway”
Job Market: should one hide their (young) age?
How do I disable login of user?
Expected maximum number of unpaired socks
Why would a rational buyer offer to buy with no conditions precedent?
Is it legal to meet with potential future employers in the UK, whilst visiting from the USA
Must a warlock replace spells with new spells of exactly their Pact Magic spell slot level?
Are runways booked by airlines to land their planes?
What is the meaning of "<&3" and "done < file11 3< file22"
Replacement stem cap and bolt
Tracking logon sessions in Office365 logs
Office365: mailbox catch-allpostfix relaying all mail through office365 problemsAdding alias to an Office 365 mailbox with dirsyncCan I customize the “Office365” link in Outlook for Office365?Office365 - cannot email DynamicDistributionGroupOffice365 Application AccountsDoes Office365 Compliance hold Outlook OWA ChatMessages?Unable to get migrate exchange mailboxes due to unknown status of MRS proxyOutlook + Office365 & VLAN issuesAzure AD with Office 365 users and a NAS share
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I am investigating data in O365 logs. Is there a way to distinguish which session a certain activity belonged? for example, if a user has his mobile phone, home PC and work PC logged on, how can I tell which device did the action?
microsoft-office-365
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
add a comment |
I am investigating data in O365 logs. Is there a way to distinguish which session a certain activity belonged? for example, if a user has his mobile phone, home PC and work PC logged on, how can I tell which device did the action?
microsoft-office-365
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
add a comment |
I am investigating data in O365 logs. Is there a way to distinguish which session a certain activity belonged? for example, if a user has his mobile phone, home PC and work PC logged on, how can I tell which device did the action?
microsoft-office-365
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
I am investigating data in O365 logs. Is there a way to distinguish which session a certain activity belonged? for example, if a user has his mobile phone, home PC and work PC logged on, how can I tell which device did the action?
microsoft-office-365
microsoft-office-365
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
asked Aug 1 '17 at 21:52
KonradsKonrads
4611234
4611234
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Taken from: Use Office 365 tools for security investigations in Exchange Online and SharePoint Online
To examine the devices and applications from which a specific user connected to a mailbox in Office 365
- In the Security & Compliance Center, choose Reports > View reports.
- Under Auditing, choose Azure AD reports.
- In the Azure management portal, on the Active Directory tab, choose the name of your organization.
- Under your organization name, choose Users.
- Locate the user you want to investigate and choose the username.
- On the user page, choose Devices.
- In the View drop-down list, select Devices and applications from which the user has signed in. This will provide details, such as the version of client used to sign in, and the last sign-in time, IP address, and location of the user.
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f866373%2ftracking-logon-sessions-in-office365-logs%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Taken from: Use Office 365 tools for security investigations in Exchange Online and SharePoint Online
To examine the devices and applications from which a specific user connected to a mailbox in Office 365
- In the Security & Compliance Center, choose Reports > View reports.
- Under Auditing, choose Azure AD reports.
- In the Azure management portal, on the Active Directory tab, choose the name of your organization.
- Under your organization name, choose Users.
- Locate the user you want to investigate and choose the username.
- On the user page, choose Devices.
- In the View drop-down list, select Devices and applications from which the user has signed in. This will provide details, such as the version of client used to sign in, and the last sign-in time, IP address, and location of the user.
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
add a comment |
Taken from: Use Office 365 tools for security investigations in Exchange Online and SharePoint Online
To examine the devices and applications from which a specific user connected to a mailbox in Office 365
- In the Security & Compliance Center, choose Reports > View reports.
- Under Auditing, choose Azure AD reports.
- In the Azure management portal, on the Active Directory tab, choose the name of your organization.
- Under your organization name, choose Users.
- Locate the user you want to investigate and choose the username.
- On the user page, choose Devices.
- In the View drop-down list, select Devices and applications from which the user has signed in. This will provide details, such as the version of client used to sign in, and the last sign-in time, IP address, and location of the user.
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
add a comment |
Taken from: Use Office 365 tools for security investigations in Exchange Online and SharePoint Online
To examine the devices and applications from which a specific user connected to a mailbox in Office 365
- In the Security & Compliance Center, choose Reports > View reports.
- Under Auditing, choose Azure AD reports.
- In the Azure management portal, on the Active Directory tab, choose the name of your organization.
- Under your organization name, choose Users.
- Locate the user you want to investigate and choose the username.
- On the user page, choose Devices.
- In the View drop-down list, select Devices and applications from which the user has signed in. This will provide details, such as the version of client used to sign in, and the last sign-in time, IP address, and location of the user.
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
Taken from: Use Office 365 tools for security investigations in Exchange Online and SharePoint Online
To examine the devices and applications from which a specific user connected to a mailbox in Office 365
- In the Security & Compliance Center, choose Reports > View reports.
- Under Auditing, choose Azure AD reports.
- In the Azure management portal, on the Active Directory tab, choose the name of your organization.
- Under your organization name, choose Users.
- Locate the user you want to investigate and choose the username.
- On the user page, choose Devices.
- In the View drop-down list, select Devices and applications from which the user has signed in. This will provide details, such as the version of client used to sign in, and the last sign-in time, IP address, and location of the user.
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
answered Aug 20 '17 at 14:36
Noor KhaldiNoor Khaldi
2,93211026
2,93211026
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f866373%2ftracking-logon-sessions-in-office365-logs%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
