Account Security Problems

How to Monitor and Alert on Global Administrator Activity in Microsoft 365

Jason Miller Oct 21, 2026 868 views

Question details

The user needs to track, audit, and receive automated alerts for actions performed by Global Administrators or changes to privileged roles within a Microsoft 365 organization.

How to Monitor and Alert on Global Administrator Activity in Microsoft 365

Product: Microsoft 365 / Microsoft Purview
Device & OS: not provided
Scenario: Ensuring organizational security by tracking sensitive administrative operations and monitoring for unauthorized privilege escalation.
Observed behavior: The goal state is to have full visibility into privileged role assignments and critical administrative activities via comprehensive audit logs and automated notifications.

Before you start

Ensure that auditing is turned on for your Microsoft 365 organization and that your account holds the necessary permissions, such as Security Administrator or Global Reader, to access Microsoft Purview compliance portals.

Solution 1Recommended

Use Microsoft Purview to Search Audit Logs and Configure Alerts

Access the Microsoft Purview compliance portal to manually search for administrator role changes and create automated alert policies for privileged actions.

Microsoft 365 relies on the unified audit log to record sensitive user and admin activities. By leveraging Microsoft Purview, organizations can filter specifically for role assignments, user management, and critical configuration changes.

Access the Microsoft Purview Compliance Portal

Navigate to the Microsoft Purview compliance portal in your web browser and sign in using your administrative credentials.

Search the Unified Audit Log

Click on 'Audit' in the left-hand navigation pane. Configure your search parameters by setting a specific date and time range. In the 'Activities' dropdown, select events related to role management, such as 'Added member to role' or 'Changed user password'.

Create a New Alert Policy

To automate monitoring, navigate to 'Policies' and then select 'Alert policies'. Click 'New alert policy' and provide a clear name and description.

Define Alert Conditions

Under the policy settings, set the activity condition to trigger when elevated administrative privileges are granted or modified. Select 'Elevation of privilege' or choose specific role assignment activities.

Assign Notification Recipients

Specify the email addresses of authorized security personnel or a shared security mailbox that should receive alerts when the policy is triggered. Save and turn on the policy.

Use Microsoft Purview to Search Audit Logs and Configure Alerts

Audit Log Retention Periods: By default, Microsoft 365 retains audit logs for 90 days. If your organization has an E5 or Compliance add-on license, you can configure audit log retention policies for up to one year or longer.

Free Microsoft Office alternative

Looking for a Secure and Free Office Suite for Your Team? Try WPS Office

While tracking Microsoft 365 administrative roles requires complex IT portals, everyday document productivity should be straightforward and accessible. WPS Office provides a lightweight, highly compatible, and cost-free alternative to traditional office suites, ensuring your team can work securely without hefty subscription fees.

1. Download WPS Office: Visit the official WPS Office website and download the free software for Windows, Mac, or Linux.
2. Run the Installer: Open the downloaded installation file and follow the quick on-screen instructions to set up the software.
3. Open Your Office Documents: Launch WPS Office and directly open your existing Word, Excel, or PowerPoint files without losing any formatting or data.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Cost-effective and free alternative for individuals and enterprise teams.Lightweight installation with built-in PDF editing and seamless tabbed navigation.Focuses on secure local file management alongside cloud capabilities.

microsoft office alternative - wps office

Frequently Asked Questions

How long does it take for administrator activities to appear in the Purview audit log?

It typically takes between 30 minutes and 24 hours for most administrative activities to become searchable within the Microsoft Purview audit log, depending on the specific service generating the event.

Can I receive real-time email notifications for Global Admin role changes?

Yes. By configuring an alert policy in Microsoft Purview or leveraging Microsoft Defender for Cloud Apps, you can trigger near real-time email notifications whenever privileged roles are modified or assigned.

Who has permission to view Microsoft 365 audit logs?

Access to Microsoft 365 audit logs is restricted by default. Only users assigned specific administrative roles, such as Security Administrator, Compliance Administrator, or the 'View-Only Audit Logs' role, can search and view this data.

Do I need a special license to audit Global Administrator activity?

Basic auditing capabilities are included in most Microsoft 365 subscriptions. However, advanced auditing features, custom alert policies, and extended audit log retention periods typically require a Microsoft 365 E5 or an advanced Compliance add-on license.

Microsoft Office Security Issues