Successful login alert for users not in Office 365 active directory

Products

• CASB Security Standard
• CASB Security Premium
• CASB Security Advanced
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced

Issue/Introduction

Policy that triggers when someone tries to login from outside the United States and triggers on successful login from users that are not in the Office 365 Active Directory.

Cause

Data is being reported acurately from the Office 365 API

Office 365's Audit log shows a "LogonError: "UserAccountNotFound" but the ResultStatus = Succeeded

Resolution

The data that is being reported is being reported from the Office 365 APIs.  To see this data do the following.

1. Go to the following url http://protection.office.com
    
2. Sign in with a Global Admin account
    
3. Expand the Search option and select Audit log search
    
4. Search for the unknown users