Ensure the Account Provisioning Activity report is reviewed at least weekly

Why This Matters

If your organization does not regularly use third party applications for user account management, any account provisioning entry in this report could indicate unauthorized access or malicious activity. Monitoring this report weekly helps you detect new or unusual third party applications that may be compromising your directory, preventing account takeover or data exfiltration.

What Aether365 Checks

Aether365 verifies that the Account Provisioning Activity report in Microsoft 365 Defender has been reviewed at least once every seven days. This check appears in your Aether365 dashboard under the microsoft-365 category and alerts you if the report has not been reviewed within the required window.

How to Fix

To manually review the Account Provisioning Activity report: