Article

Event Reporting: Admin Center Coverage and IP Enrichment - now generally available

by Product Marketing

June 8, 2026

The Event Reporting audit feed now extends into the Admin Center, capturing administrative actions including authentication and SSO/MFA changes, security controls, data-governance policies, and more — providing a record for your most sensitive administrative actions. User login and logout events, including failed attempts, are captured for the first time. And events can now carry the originating IP address, giving your security team the context to correlate activity, detect anomalies, and investigate incidents. 
See the following links for a list of events added: Admin center events | authentication events

  • Environment Availability: Commercial US, EU, AU

  • Plan Availability: Enterprise, Advanced Work Management

  • Subscription Model Availability: Legacy Collaborator Model and User Model