question

BenHarden-0610 avatar image
0 Votes"
BenHarden-0610 asked JadeLiang-MSFT edited

outlook login IP addresses/ Audit logs

I have what is hopefully a simple question. I am an admin for a office 365 account. Our company has a number of email accounts, one for each employee. I know that if I go to the office 365 admin page then navigate to compliance and then to the audit logs page I can get a list of the IP addresses of the all the user's logins for the last three months. I want to be able to do this automatically through and API. I know the information exists because I can get it using the GUI on the website. Can anyone help me find the API where I can access this? I have looked in many locations in the docs and using 'graph' and have been unable to find a way to access this information other than on the website.
For background I am using these IP addresses to find the locations of the logins to help us know immediately when our emails have been compromised. If there is another way to do this through an API that does not involve getting the IP address I would accept that as a solution as well.

not-supported
· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Hi @BenHarden-0610 ,
Welcome to our forum, please kindly understand here we mainly focus on general issue on Outlook desktop client, considering your issue may be more related to API, I would modified your tag to "not supported" , thanks for your understanding.

0 Votes 0 ·

1 Answer

michev avatar image
1 Vote"
michev answered michev commented

You have two options here:
1) Use PowerShell to get the information from the Unified Audit Log (Search-UnifiedAuditLog) or from the Mailbox audit logs (Search-MailboxAuditLog)
2) Use the Management Activity API to get the same info via REST-based HTTP requests: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Option 2 is definitely more what I was looking for thank you so much for your quick answers. when using the Managemnet Activity API to get this info, do I need to purchase the "Azure AD P1 liciense"?

0 Votes 0 ·

No need for any additional subscription.

1 Vote 1 ·