O365 Disable MFA Analytics

[saskn]

https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/

when i give this command Oper...

`o365_management_activity` Operation="Disable Strong Authentication." 
| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation UserId ResultStatus object 
| rename UserType AS user_type, Operation AS action, UserId AS src_user, object AS user, ResultStatus AS result 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `o365_disable_mfa_filter`

as per the

[scelikok]

Hi @saskn,

If the query works when Operation!="Disable Strong Authentication.", it shows no user disabled MFA. Normally, you have no results if all users are using MFA.

[saskn]

the above query not working but when i Operation!="Disable Strong Authentication."  getting enabled mfa users list.

i have already ingested the Splunk logs and completed the macro creation