As a CA Administrator, I would like to use a minimally privileged account to facilitate O365 and Azure auditing (4249327)

Currently, it is required that a Global Administrator account is specified during Azure and O365 template creation:

 

Azure:

A user account with the Global Administrator role is required for auditing configuration. The account must be sourced from Azure Active Directory. Accounts from other sources are not supported

 

O365:

The user account specified for the Configuration Account must be assigned the Global Administrator role. The account must also be licensed for Exchange Online (other Office 365 licenses are not required). The account must also be assigned the Exchange Administrator role. 

 

It would be beneficial if an administrator could specify a lower privilege account if Global Administrator is not required after initial configuration.

For Office 365 Exchange Online the Exchange Administrator role is used to configure the mailbox auditing settings in the tenant that are defined in the template (such as enabling auditing of owner activity). The agent periodically uses these credentials to validate or update auditing settings, so they are securely stored in Change Auditor.


Create an Azure Active Directory auditing template:
https://support.quest.com/technical-documents/change-auditor/7.4/office-365-and-azure-active-directory-user-guide/6#TOPIC-2113775