How to Automate Microsoft 365 Role Change Notifications for Admin Oversight. Role changes in Microsoft 365 are one of the most common ways security incidents start, yet they’re often buried in logs no one checks. In this video, you'll learn how to automate Microsoft 365 role change notifications so privilege changes are detected, alerted on, and fully auditable. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Enable and Verify Audit Logging. Before you automate anything, you need to ensure audit logging is enabled so role changes are actually captured. Using PowerShell, run the following commands: Ensure the Unified Audit Log is enabled... Check status... Use PowerShell to Query Role Assignment Changes. You can also use PowerShell to quickly check recent role changes in a tenant’s Microsoft 365. Utilize Windows Task Scheduler or your RMM platform to automate alerts for these updates. Query audit logs for role changes... Filter output... Use Microsoft Graph API for Role Assignment Monitoring. Microsoft Graph allows you to check recent role modifications and works especially well if you’re managing multiple tenants and need deeper API-level visibility. First, authenticate using: Authenticate with Microsoft Graph... Query role assignments... Compare with the previous state stored in a local file or registry to detect new assignments... Use Registry Keys to Track Last Audit Check. Keeping track of the last successful audit check in the registry ensures that all your scripts are running properly. Run the following commands to create and update the registry key. To take note of the last successful scan... To verify... Use Group Policy to Restrict Local Role Elevation on Devices. Group Policy can be used to tightly control who has administrator access and prevent unauthorized local admin group changes. Navigate to: Computer Configuration, Windows Settings, Security Settings, Restricted Groups. Prevent unauthorized access by automating role change notifications in Microsoft 365. Administrative roles are some of the most sensitive resources for any organization. Automate alerts for Microsoft 365 role changes so that you or your IT team never miss updates. Doing so will help strengthen your security posture. For more information, check out our official blog post on “How to Automate Microsoft 365 Role Change Notifications for Admin Oversight” linked in the description below. Be sure to subscribe to Ninja One's IT Video Hub and our YouTube channel for more tech content like this.