戻る
-
タイトル
O365 Auditing Template Overwriting Office 365 Native Audit Settings -
説明
When an O365 template is applied to an agent, and the template enabled, any existing native Office 365 settings are overwritten. -
原因
This is by design so that the user does not have to edit the audit settings in Change Auditor AND O365.
This is documented in the Office 365 and Azure Active Directory User Guide:
"Auditing settings that have been previously configured in the tenant for Exchange Online by third-party software are overwritten by the auditing setting specified in the Office 365 template when the configuration is applied."The Change Auditor Cloud plugin will periodically refresh the O365 mailbox auditing configuration applied to mailboxes to ensure the required auditing is in place.
-
対策
This function can be disabled to retain the native tenant settings in O365 by implementing the DisableO365MailboxAuditConfig registry key.
By implementing the key, it would leave all O365 auditing settings as they currently are, and you can update the settings going forward.
*****Please be aware that new mailboxes that are added to be audited would need to be manually configured for auditing.- Stop the CA Agent that is assigned to the Office 365 template
- Set or create the following registry key on the CA Agent computer to prevent the agent from setting the auditing properties for O365 mailboxes:
HKEY_LOCAL_MACHINE\SOFTWARE\Quest\ChangeAuditor\Agent\Settings\DisableO365MailboxAuditConfig
Type: DWORD
Value: 1 - Start the CA Agent that is assigned to the Office 365 template