Microsoft 365: Active Directory Monitoring

Use Active Directory Monitoring to review identity risks across Active Directory and Entra ID.

A Microsoft 365 integration must be configured for the tenant before an Active Directory scan can run.

See [Microsoft 365 Integration Guide].

Open Active Directory Monitoring

1. Access the tenant.

2. Open the module selector.

3. Select Microsoft 365.

4. Select AD Monitoring.

Run an Active Directory Scan

Active Directory scans can be started directly from the AD Monitoring page.

1. Select New Scan.

2. Enter a Scan Name.

3. Choose Run Now or configure a recurring schedule.

4. Optionally enable Notify on Completion.

5. Select Submit.

Review Scan Results

Completed Active Directory scans are available from the scan selector at the top of the AD Monitoring page.

Select a scan from the dropdown to review its results.

Results include:

• Findings

• Users

• Devices

• Groups

• MFA Status

The summary cards highlight findings such as stale passwords, stale accounts, and accounts without MFA.