You will be warned of any account creation not initiated by you. From a security standpoint, creating a new account is a very common action for hackers that gain access to an organization. For internal monitoring: you can reduce cost and increase compliance by limiting accounts created without approval. 


Remediation


We recommend that you block sign-in on unapproved created accounts until the activity has been properly activated. 

Details on the admin who created the account are available through the Report section in Office Protect. If you want to investigate the activity on the newly created account or the admin who created the account, we recommend performing an audit logs search in the Audit Logs.


Office Protect Advanced Report provides multiple reports and insights on Microsoft 365 user accounts, along with details about licenses, their creation date, etc.