AlertControl for system administrators: all Microsoft 365 logs on one timeline
AlertControl for Microsoft 365 reads sign-ins, the Entra audit log, the unified audit log, Defender alerts and incidents, risk detections and DLP matches through Microsoft Graph and the Office 365 Management Activity API. Everything appears on one timeline, with a severity per event and all details in a clear view. The app only uses read-only application permissions.
Updated 2 November 2026
| Source | What you see (retention in AlertControl) |
|---|---|
| Sign-ins (Entra ID) | Interactive sign-ins with result, error code, country, device and Conditional Access per policy (up to 30 days; Entra ID P1) |
| Audit Log (Entra ID) | Changes to users, groups, roles and apps, with old and new value (up to 30 days) |
| Events (unified audit log) | Exchange, SharePoint, OneDrive and Entra: inbox rules, mailbox permissions, sharing, downloads (up to 7 days) |
| Security alerts and incidents | Alerts from Microsoft Defender XDR and Entra ID Protection, with evidence and MITRE techniques |
| Risk detections and risky users | Risk detections and risky users from Entra ID Protection (Entra ID P2) |
| Users & MFA | Registered methods, last interactive and non-interactive sign-in, last password change |
| DLP | Matches with DLP policies in Microsoft Purview (up to 7 days) |
How severity is determined
Alerts and incidents keep Microsoft's severity. For sign-ins: successful in the home country is informational, failed is medium, successful from abroad or ten failures within four hours is high. Interrupted sign-ins, such as an MFA prompt or "Stay signed in?", do not count as failed. The Audit Log and Events use rules per activity, such as a new inbox rule or a role change; actions by system accounts get a lower severity.
Details per event
Click a row or timeline item for a structured view: for a sign-in, the result with error code and reason, location with country, device, risk and a table of every Conditional Access policy and its result. For an alert, the evidence and MITRE techniques; for the Audit Log, the old and new values. All fields are searchable and can be copied as JSON.
Permissions and security
The app uses one multi-tenant app registration with read-only permissions, such as AuditLog.Read.All, SecurityAlert.Read.All and ActivityFeed.Read. Tenant data is only shown to users with a suitable role in the Microsoft wids claim; each table requires the same roles as in Microsoft itself. Sessions last at most 8 hours and roles are rechecked every fifteen minutes.
Frequently asked questions
Microsoft Graph v1.0 and the Office 365 Management Activity API, with read-only application permissions, including AuditLog.Read.All, Directory.Read.All, SecurityAlert.Read.All, SecurityIncident.Read.All, IdentityRiskEvent.Read.All, ActivityFeed.Read and ActivityFeed.ReadDlp.
Yes, for Events and DLP. AlertControl starts the Management Activity API subscription itself on the first visit; the first data arrives within 12 hours.
Data is fetched when you open the dashboard and kept for 5 minutes; Refresh fetches it again immediately. Microsoft itself has some delay, especially for the unified audit log.
See for yourself what is happening in your Microsoft 365?
Try AlertControl free for 30 days. You sign in with your Microsoft account and grant read-only consent once.