As a CA Administrator, I would like to use a minimally privileged account to facilitate O365 and Azure auditing (4249327)

Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

As a CA Administrator, I would like to use a minimally privileged account to facilitate O365 and Azure auditing
Description

Currently, it is required that a Global Administrator account is specified during Azure and O365 template creation:

Azure:

A user account with the Global Administrator role is required for auditing configuration. The account must be sourced from Azure Active Directory. Accounts from other sources are not supported

O365:

The user account specified for the Configuration Account must be assigned the Global Administrator role. The account must also be licensed for Exchange Online (other Office 365 licenses are not required). The account must also be assigned the Exchange Administrator role.

It would be beneficial if an administrator could specify a lower privilege account if Global Administrator is not required after initial configuration.
Cause

Expected behavior.
Resolution

Global Admin is required as it is needed to create the Enterprise Web app in Azure and assign the required permissions for CA to audit Azure AD and Office 365. After the web application is created, the credentials are no longer used. The agent retrieves the web application ID and key and securely stores them. The agent uses the ID and key to retrieve events from Azure AD and Office 365.

Note: The ID and Key have a 50 year expiration date.

For Office 365 Exchange Online the Exchange Administrator role is used to configure the mailbox auditing settings in the tenant that are defined in the template (such as enabling auditing of owner activity). The agent periodically uses these credentials to validate or update auditing settings, so they are securely stored in Change Auditor.

Create an Azure Active Directory auditing template:
https://support.quest.com/technical-documents/change-auditor/7.4/office-365-and-azure-active-directory-user-guide/6#TOPIC-2113775
Defect ID

VSTS0021794

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Request a KB Article

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

As a CA Administrator, I would like to use a minimally privileged account to facilitate O365 and Azure auditing (4249327)

Title

Description

Cause

Resolution

Defect ID

Leave a Comment