locked
view login failed in office 365 RRS feed

  • Question

  • First of all, thanks for everything.

    I am connected to the office 365 logs to my always SPLUNK.

    I can see the logs that he sends me. for the moment everything is fine.

    I have enabled 0365 to audit the mailboxes and I get information about when a user is signing in, but for example, I do not see when a user has tried unsuccessfully to login

    I have seen manuals relating to auditing the active directory, and it is assumed that we have done well, but we do not see the login failed events in the security center or splunk.

    Can you help me by indicating where or how I can see the failed logins of an office 365 mailbox? Thank you !!!

    http://kinomakino.blogspot.com

    Thursday, January 24, 2019 8:42 AM

All replies

  • Hi,


     This IT Professional forum is for general questions, feedback, or anything else related to the RTM release versions of Office 2013 and Office 365 ProPlus. Your question is mainly related to Office 365 for Admin. To help you better solve the problem, I suggest you ask questions on Microsoft Community for help. Maybe you could get more helpful suggestions there. 

    As far as I know login history/log event can be viewed through Office 365 security & compliance center. If you turn on mailbox audit logging for all users prior. Also it is needed to set up permissions for all users. Please refer to the article from Microsoft: Search the audit log in the Office 365 Security & Compliance Center. Here is a KB on this: How to use mailbox audit logs in Office 365.

    Hope you could resolve the question smoothly. Please remember to mark the reply as answer if it helps.

    Best Regards,

    Herb


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Office 2019.


    Friday, January 25, 2019 9:12 AM
  • thanks for the recommendation of the forum. I will follow it.

    Regarding the manual that indicates me, we have already tested it and it does not record the failed logins.

    Thank you !!!

    http://kinomakino.blogspot.com

    Monday, January 28, 2019 11:52 AM
  • Hi,

    I am checking the status of this issue. Have you resolved this problem smoothly? Do you have any update for it? Do you need further help?

    Best Regards,

    Herb


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

    Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Office 2019.


    Monday, February 11, 2019 1:43 AM
  • Hi,

    You can use Search-UnifiedAuditLog with 'UserLoginFailed' operation. else, try this script which will help you to track failed login attempts.

    Export Office 365 Users failed login attempts

    This script supports more advanced filtering options to get more granular result.

    Tuesday, December 24, 2019 6:44 AM