Audit Logs: User Management/Core Directory Verification

Question

Just verifying that ******@support.onmicrosoft.com in our Audit Logs are in fact a user that has reset their password and not something fictitious that needs to be addressed?

Answer 1

@Jenn Clem Yes that is a expected log entry when the SSPR service tries to reset the password. The MS logs that service as ******@support.onmicrosoft.com
A successful SSPR operation will first show the user who performed SSPR performing verification steps, submitting a new password, and then the ******@support.onmirosoft.com service account resetting the user’s password

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.