Created by Claude - please verify

Security-info changes - activity names are matched by text; the target is matched to administrators by display name.

Required Microsoft Graph permissions

AuditLog.Read.All — application permission, granted to the app registration with admin consent.

Endpoints: GET /v1.0/auditLogs/directoryAudits · GET /v1.0/reports/authenticationMethods/userRegistrationDetails (admin flag)

Covers activities containing 'security info', 'temporary access pass', 'authentication method' or 'strong authentication'. Audit window: 30 days at most (the Directory Changes data).

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Security-info Changes & Temporary Access Passes

Registering a new phone or authenticator is how an attacker who got one sign-in makes access permanent - and a Temporary Access Pass issued by a helpdesk is how social engineering gets in. Changes on administrator accounts are listed first.

No authentication-method changes or Temporary Access Passes in the audit window.