Purview - Search for IP?

[Jawloms]

Morning,

 

I'd like to search my O365 tenancy for activity from a specific IP. Is it possible? Not getting much luck Googling......

 

Thank you

 

Stuart

[psydii]

you can do this from cloud app activity log in defender.

[Jawloms]

you can do this from cloud app activity log in defender.

 

I don't have that. Apparently you only get that with E5 licences?

[psydii]

Try the authentication logs in Entra? Users->All Users ->Sign in logs. I think everybody gets those.

 

Also, https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

and https://learn.microsoft.com/en-us/purview/audit-log-enable-disable?tabs=microsoft-purview-portal

seem to suggest with a bit of (probably tricky) fiddling around you can access this data with custom scripts. "Audit logging is turned on by default for Microsoft 365 organizations"

 

I know there was a bit of a bruhaha a while back because this data is required for basic forensic analysis, and the general view from the community was the 'raw' data should be available even without E3 / E5. I think the upshot was that with work (scripting) you can get to the data without a Purview/Compliance addon or E5. But I could be misremembering where this all landed in the end.

Edited May 20, 2024 by psydii

[mullet_man]

I've used this before, export a few days activity and then search the CSV for that IP.

 

https://o365reports.com/2019/12/23/export-office-365-users-logon-history-report/