Can we get the report of admin account which was used by helpdesk team for granting and providing admin actions on devices via Entra ID or any other way?

Vinod Survase 4,721

For example: User ABC needs to install the particular app on his/her device and they raised a ticket to helpdesk support and helpdesk took remote session of the users machine and provided an admin credentials to install the app on device with admin privileges so where is that entry or record gets stored in Entra ID or any other place and how we can get the report of it?

Rahul Jindal [MVP] 9,551 Reputation points MVP

2024-01-06T18:27:31.4666667+00:00

To my knowledge, such elevated actions don’t get logged in Entra. Closest entry that I can think of is when the elevated account is used to complete authentication which should then log as a sign-in event in Entra ID. Also, the elevated action should generate an entry in the windows event logs. If the devices are onboarded on to MDE, then it should be possible to pull the details using Advanced hunting. Else, you are looking at a custom solution involving PS scripts and log analytics. On a side note, what is the nature of the admin account? Is it through LAPS?
Vinod Survase 4,721 Reputation points

2024-01-08T10:12:27.1433333+00:00

Hi Rahul Jindal [MVP]

No its not through LAPS. The admin account was given EMS E5 license and Intune admin role and was working admin on each device to perform admin actions.
JamesTran-MSFT 36,531 Reputation points Microsoft Employee

2024-01-12T19:52:05.13+00:00

@Vinod Survase
I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.
Sandeep G-MSFT 16,361 Reputation points Microsoft Employee

2024-02-02T06:20:28.7433333+00:00

@Vinod Survase
Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread.

1 answer

Sandeep G-MSFT 16,361 Reputation points Microsoft Employee

2024-01-08T08:35:09.86+00:00

@Vinod Survase

There is no option to get the admin account that was used by your helpdesk to elevate access while installing an application in device.

However, there is another way that you can use to get the account details only if they had used any of the Entra ID account.

You can check on user device and get the timing of the application which was installed in their device. At the same time, you can check Entra ID sign-in logs for that time and check the account that was authenticated.

If helpdesk has used any of the Entra ID account, then this account would get authenticated again Entra ID. All authentication logs would be tracked in sign-in logs of Entra ID.

Or you can check event logs in the device itself to confirm what was the account that was used to install the application in the device.

Let me know if you have any further questions on this.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Vinod Survase 4,721 Reputation points

2024-01-08T10:16:47.41+00:00

Hi Sandeep G-MSFT

Thanks for sharing this info. I will check the Sign-in logs and see if it gives the details.
Sign in to comment

Share via

Can we get the report of admin account which was used by helpdesk team for granting and providing admin actions on devices via Entra ID or any other way?

1 answer