All Microsoft 365 security events on one timeline
The AlertControl timeline lists the security events of the last 24 hours from all your Microsoft 365 sources, newest first: sign-ins, changes in Entra ID, activity in Exchange, SharePoint and OneDrive, alerts from Microsoft Defender and DLP. Every event shows its source and severity. So you see at once what happened.
Updated 31 October 2026
Why one timeline?
In Microsoft 365, sign-ins live in Microsoft Entra, mailbox and file activity in Microsoft Purview and security alerts in Microsoft Defender, each with its own search screen. If you want to know what happened around a suspicious sign-in, you put the puzzle together yourself. On the timeline everything is side by side, so you see what happened before and after.
What is on the timeline?
• Security alerts and incidents from Microsoft Defender
• Identity risk detections and risky users from Entra ID Protection
• Sign-ins, with the country and, for a failed sign-in, Microsoft's reason
• The Entra ID audit log: changes to users, groups, roles, apps and policies
• Events from Exchange, SharePoint, OneDrive and other workloads
• DLP alerts
How you use it
• Turn a source on or off with the buttons at the top; All on switches them back.
• Use the severity filter to choose what you see, medium and higher by default.
• Click an event for all details, with the source clearly shown.
• The timeline shows 200 events at a time; Show more takes you further back.
With AI advice
Want to know what to do first? The AI advice assesses the same data and gives the most important findings in plain language, with the steps to take. AI advice is included in the Business bundle and higher.
Frequently asked questions
The timeline shows the last 24 hours. For a longer period you use the dashboard, where the slider lets you look back up to 7 or 30 days, depending on the source.
At least one user with Microsoft Entra ID P1, for example through Microsoft 365 Business Premium. Without that licence the sign-ins, among other things, are missing; the audit log and the events from Exchange and SharePoint do work.
Yes. The timeline is included in all bundles, from Starter at €10 per month. AI advice is included in Business and higher, from €25 per month. We invoice yearly.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.