Converse agora com nosso suporte
Chat com o suporte

Change Auditor 7.6.1 - Microsoft 365 and Microsoft Entra ID Auditing User Guide

Microsoft 365 and Microsoft Entra ID Auditing Overview Configuring Microsoft 365 and Microsoft Entra ID auditing Reports and Searches

Deployment requirements

Deployment requirements

To successfully audit and report on events, ensure that your environment meets the minimum system requirements and you have reviewed the deployment information.

•
System requirements
•
License requirements
•
Auditing and agent considerations
•
Auditing in synchronized environments
•
Upgrading Change Auditor

System requirements

For information about system requirements, see the Change Auditor Release Notes. For details on installing Change Auditor, see the Change Auditor Installation Guide.

License requirements

Change Auditor stops collecting events if a license expires. After you apply a license, the agent collects available events from the tenant that were missed. The Microsoft 365 and Microsoft Entra events are retained in the tenant for a specific period depending on your subscription type. If this period elapses before a new license is applied, some events are lost.

* 
NOTE: Change Auditor now has a Change Auditor Government Cloud license available that enables the creation of Microsoft Entra ID and Microsoft 365 auditing templates specifically for GCC and GCC High tenants. However, it does not include auditing capabilities on its own. To audit specific services, you must also have the appropriate Change Auditor license types:
•
Entra ID directory auditing requires the Change Auditor for Active Directory license.
•
Entra ID sign-on and risk auditing requires the Change Auditor for Logon Activity User license.
•
Microsoft 365 Exchange Online auditing requires the Change Auditor for Exchange license.
•
Microsoft 365 SharePoint Online and OneDrive auditing requires the Change Auditor for SharePoint license.
* 
NOTE: To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Auditing and agent considerations

When auditing Microsoft 365 and Microsoft Entra ID, keep the following in mind:

•
Occasionally duplicate auditing events are produced. This can occur when a service disruption requires that Microsoft administrators replay database transaction files to ensure that no events are lost. Change Auditor removes duplicated events that come in at the same time, but if an event that has already been sent to our database is sent again from Microsoft 365 it is displayed as a duplicate.
•
By default. auditing settings that have been previously configured in the tenant for Exchange Online by third-party software are overwritten by the auditing setting specified in the Microsoft 365 template when the configuration is applied. You can, however, select to not overwrite the tenant settings.
•
Change Auditor collects Microsoft's audit logs, and as a result the events and details reported are limited to what these logs provide.
•
Change Auditor checks for new Microsoft Entra events every 15 minutes and for new Microsoft 365 events every 5 minutes.
•
You can create multiple Microsoft Entra or Microsoft 365 templates to monitor multiple tenants; however, you must select a different agent for each template. A single agent cannot monitor multiple tenants. A single agent can audit both Microsoft Entra ID and Microsoft 365 against the same tenant.
•
If your organization uses a proxy server to connect to the internet, you must configure the Proxy Server settings on the Agent Configuration page to audit Microsoft Entra and Microsoft 365 targets.
•
The following URLs must be accessible for cloud auditing to be fully functional:
 
Commercial
GCC
https://login.microsoftonline.com
https://graph.microsoft.com
https://outlook.office365.com
https://manage.office.com
https://login.microsoftonline.com
https://graph.microsoft.com
https://outlook.office365.com
https://manage-gcc.office.com
Documentos relacionados

The document was helpful.

Selecione a classificação

I easily found the information I needed.

Selecione a classificação