I'm looking to configure alerts for when a new user is created in Microsoft 365 without incurring extra costs for Azure alerts. Ideally, admins should receive notifications whenever a new user is added. I remember Microsoft Defender had a feature for this previously, but I'm curious if it's possible to set this up now in the security admin center or through other means.
3 Answers
Have you thought about using AD Audit? It's a really effective tool for monitoring who is making changes in your organization. You can check it out [here](https://www.manageengine.com/products/active-directory-audit/) for more insights.
To log new user creations, you’ll want to configure audit policies in Group Policy. After that, you can use a SIEM system, PowerShell scripts, or third-party tools to monitor and receive alerts on specific event IDs related to user creation.
Currently, there isn’t a straightforward built-in option to get alerts for new user creation in M365. However, a workaround is to use a PowerShell script that can be scheduled to run daily. The script tracks new user creations, details who created them, and can even be adjusted to send email reports automatically. You can find a guide for this setup [here](https://o365reports.com/2023/08/01/find-who-created-user-account-in-microsoft-365/).
Thanks for the info! Just to confirm with my admins, there's no option for setting up a Defender alert for this, right?
Will I be able to access this feature if I have the Business Premium plan?