Lesson 7 of 64
Getting started
Review sign-ins, sessions and security audit history
Investigate account activity using alerts, sign-ins, sessions, trusted devices and audit records.
Before you begin
Use the security view permitted to your role and identify the time and account under review.
Step by step
- Open Security Centre and choose the period for alerts and sign-in summaries.
- Review successful and failed sign-ins, method and device information to identify unfamiliar activity.
- Inspect active sessions and trusted devices using the controls available to your account. Review the effect before revoking access.
- Open the exact alert or audit record and review actor, resource, changed fields and time.
- Review the displayed retention policy and use the permitted security archive download when a record must be retained for review.
Check the result
Evidence should identify the relevant account and event; archive availability follows the displayed retention policy.
Common question
Is audit history retained forever?
No. Read the current retention duration in Security Centre; expired records may be permanently removed.