While we were touring the United States of America on our MEC Road Trip I started receiving these emails to our admin account and I had not seen them before so it sure got my attention.
I could not remember turning anything on or seeing or hearing about this before so when I started to investigate it turned out that I had opt/in to the beta of Azure Active Directory Premium and the reports I started receive where the so called
Advanced Security Reports and Alerts: Use detailed machine learning-based reports showing sign in activity, inconsistent access patterns, and potential threat areas. Get alerts for possible threats and take actions to mitigate risks.
And apparently it does indeed work, the reason I received them is because I logged on from different locations in a short amount of time. Actually I traveled back in time as I was first in Japan and then flew to Los Angeles and Azure AD premium took notice and sent out these reports.
Great feature and something that my customers often asks about when we talk about security.
In fact this is even something that many on-premises customers do not have, so I will add this to the list of why Office 365 and Microsoft Azure is more secure than running servers on-premises
If I opened up the reports from the link View detailed report my browser will take me in to Azure and the irregular sign in activity page. (yes it says Stockholm now because that’s where I were when I took the screen shoots, just after I landed from the US)
I can also get a csv file of the report that I can filter in Excel for easier analysis.
Some other reports that you get with Azure Active Directory Premium and the Advanced Security Reports and Alerts pack
The two options and a list of what’s included.
If you want to read more about Azure Active Directory Premium and a comparison between the free and the premium offering.
Head over to the official pages at http://msdn.microsoft.com/library/azure/dn532272.aspx