Chatta subito con l'assistenza
Chat con il supporto

Change Auditor 7.6 - Microsoft 365 and Microsoft Entra ID Auditing User Guide

Microsoft 365 and Microsoft Entra ID Auditing Overview Configuring Microsoft 365 and Microsoft Entra ID auditing Reports and Searches

Auditing in synchronized environments

Microsoft allows you to map identities between on-premises applications and cloud services. This is done by synchronizing your on-premises directories with Microsoft Entra ID using a Microsoft synchronization tool. When auditing Microsoft 365 or Microsoft Entra ID in this synchronized environment, Change Auditor provides extra event details by mapping identities.

The following conditions must be met for Change Auditor to perform the mapping:

•
Synchronization performed with Microsoft Entra Connect.
•
Microsoft Entra Connect synchronization process is active in your on-premises environment and directory sync is active in your cloud environment.
•
Microsoft 365 or Microsoft Entra auditing template has been created to audit your online environment that is being synchronized with the on-premises Active Directory.
•
The agent that is specified in the auditing template must be a member server of the forest being synchronized with Microsoft Entra ID.
* 
NOTE: When synchronizing multiple forests into a single tenant, Change Auditor only provides additional information for the identities in the forest where an agent performing the Microsoft 365 auditing is installed.

When Federation with AD FS is used as the single sign-on method, Microsoft Entra logon events will no longer be generated since the authentication is done by the on-premises AD FS instance.

Upgrading Change Auditor

As of Change Auditor 7.2.0, Microsoft Entra and Microsoft 365 auditing templates will require MSAL (Microsoft Authentication Library) for authentication. New templates will no longer support basic authentication. Also, certificate authentication will now be required for web applications associated with Microsoft 365 auditing templates. See Managing Microsoft 365 templates for details.

When you upgrade from Change Auditor version 7.0.3 or earlier:

•
Microsoft Graph API permissions must be applied on the web application associated with any existing Microsoft Entra and Microsoft 365 auditing templates for auditing to continue. For the list of required permissions see Edit a Microsoft Entra auditing template and Edit a Microsoft 365 auditing template.
To apply the updated permissions, edit any existing templates and select the option to create a new web application to associate with it. The new web application will be created with the required permissions and auditing will continue.
* 
NOTE: Alternately, you can update the existing web application associated with the template by adding the required permissions directly on the web application in the Microsoft Entra admin center. See Edit a Microsoft Entra auditing template and Edit a Microsoft 365 auditing template for the list of required permissions. Once the permissions have been updated, restart the agent service for the new permissions to be applied immediately and auditing will continue.

When you upgrade from Change Auditor version 6.9.0 or earlier:

•
Previously created Exchange Online auditing templates are deleted and will no longer display in the client.
•
Agents previously assigned to audit Exchange Online stop auditing the Microsoft 365 Exchange Online tenant.
* 
NOTE: You can still search and report on previously captured events. All legacy events are shown in either the Microsoft 365 Exchange Online Mailbox facility or the Microsoft 365 Exchange Online Administration facility.
•
The Shared\Built-In\Exchange Online search folder is only available if it contained previously created Exchange Online custom searches.
•
To capture sign-in risk events, you need to create a new template and select the Sign-ins option. These events are not captured automatically by an existing Microsoft Entra template.
To capture new events with Microsoft 365 and avoid losing any audited activities, after an upgrade:
1
Upgrade existing agents to the latest version.
2
Create an Microsoft 365 auditing template and configure Exchange Online auditing.

 

Configuring Microsoft 365 and Microsoft Entra ID auditing

Configuring Microsoft 365 and Microsoft Entra ID auditing
•
Managing Microsoft 365 templates
•
Managing Microsoft Entra templates
•
Considerations

 

 

 

Managing Microsoft 365 templates

Change Auditor audits activity for Exchange Online, SharePoint Online, and OneDrive for Business that corresponds to the events in the Microsoft 365 Security & Compliance Center unified audit log. Change Auditor allows you to easily track, report, and create alerts on activities such as:

•
When Exchange Online mailboxes are created, deleted, and accessed.
•
Permission changes to see which users are granted access to a mailbox.
•
Mailbox activity by non-owner such as messages sent, read, deleted, and folders deleted
•
Mailbox activity by owner for sensitive and high value mailboxes.
•
When files and folders are accessed, created, deleted, uploaded, moved, renamed, and checked in and out of SharePoint Online and OneDrive for Business sites.
* 
NOTE:  
•
Due to enhanced security measures, basic authentication is no longer supported for Microsoft 365 auditing; certificate authentication is now required.
•
If you have existing Microsoft 365 auditing templates, the web application associated with them must be updated or replaced to support certificate authentication. See Edit a Microsoft 365 auditing template and for details.

For a compete list of events, their description, and default severity see the Change Auditor Microsoft 365 and Microsoft Entra ID Event Reference Guide.

See also:

•
Microsoft 365 auditing page
•
Create an Microsoft 365 auditing template
•
Disable a template
•
Delete a template
Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione