Regresar
-
Título
As a CA Administrator, I would like to use a minimally privileged account to facilitate O365 and Azure auditing -
Descripción
Currently, it is required that a Global Administrator account is specified during Azure and O365 template creation:Azure:A user account with the Global Administrator role is required for auditing configuration. The account must be sourced from Azure Active Directory. Accounts from other sources are not supportedO365:The user account specified for the Configuration Account must be assigned the Global Administrator role. The account must also be licensed for Exchange Online (other Office 365 licenses are not required). The account must also be assigned the Exchange Administrator role.It would be beneficial if an administrator could specify a lower privilege account if Global Administrator is not required after initial configuration. -
Causa
Expected behavior. -
Resolución
Global Admin is required as it is needed to create the Enterprise Web app in Azure and assign the required permissions for CA to audit Azure AD and Office 365. After the web application is created, the credentials are no longer used. The agent retrieves the web application ID and key and securely stores them. The agent uses the ID and key to retrieve events from Azure AD and Office 365.
Note: The ID and Key have a 50 year expiration date.
For Office 365 Exchange Online the Exchange Administrator role is used to configure the mailbox auditing settings in the tenant that are defined in the template (such as enabling auditing of owner activity). The agent periodically uses these credentials to validate or update auditing settings, so they are securely stored in Change Auditor. -
ID de defecto
VSTS0021794