Office 365 admins are responsible for a wide range of security-related issues in their O365 tenants, including tracking and reporting on irregular or unusual sign in activity.

Monitoring this type of activity is important, because an irregularity could indicate a potential malicious act… or it may just mean a user needs reminding about a policy. Either way, Azure AD reports can help.

To view reports on irregular or unusual sign in activity:

1. From the admin center, select Azure AD in the sidebar.
2. Select your Office 365 domain.
3. Click on REPORTS.
4. View a report from the ANOMALOUS ACTIVITY section, or, if you have Azure Active Directory Premium, view the Irregular sign in activity report.