Chat now with support
Chat with Support

Change Auditor 7.0.3 - Office 365 and Azure Active Directory User Guide

Office 365 auditing page

The Office 365 auditing page contains a list of auditing templates that define the Office 365 services and Exchange Online mailboxes to audit.

The following information is displayed for each template:

Create an Office 365 auditing template

The following section describes the steps to create a template and the required web application so you can begin to audit the Office 365 activity.

2
Click Auditing.
3
Select Office 365 (under Applications).
4
Click Add to open the auditing wizard.

Ensure the following permissions are assigned to the Azure web application:

Windows Azure Active Directory

Application Permissions:

Delegated Permissions:

Office 365 Management APIs

Application Permissions:

Delegated Permissions:

7
Click Select agent to view available agents and whether they are assigned to an Office 365 auditing template. The Office 365 cell contains ‘None’ if an agent is not assigned to a template, or ‘Auditing’ if it is assigned to a template. From this list, select the agent to capture the events and click OK.
b
Click Next to select the activities to audit within the Exchange Online organization.
Table 3.  

All administrative events

All changes made by administrators to the Office 365 Exchange Online organization.

All mailboxes for non-owner events

By default, only activities performed by users other than the mailbox owner (non-owner activity) are audited. You can however, disable this option and audit only specific mailboxes.

When you disable this option:

Select mailboxes

 

1
Click Select mailboxes.

Owner events

To optionally add owner auditing on specific mailboxes, enable the Include Owner Activity option.

The "Owner Activity" audited on a configured mailbox include folder, message, and login events.

2
Locate the required mailbox to enable or disable to Include Owner Activity as required.
9
Click Next to optionally specify the generic events to exclude from auditing based on their operations. The operations are visible in the "Activity Name/Operation" column of the Office 365 built-in searches. Generic events are dynamically created when associated activity is detected that does not have a corresponding event defined in Change Auditor. See Working with generic Office 365 and Azure Active Directory events for more information.
10
Click Finish to create the template.

Edit a template

This section describes the steps to add or remove an Office 365 service to audit; update the account used by the agent to maintain Exchange Online auditing configuration; and update the mailboxes and type of Exchange Online events to monitor.

To select a new agent, you must create a new template or use the Set-CAO365Template command through PowerShell. (See the Change Auditor PowerShell Command Guide for details.)

2
Click Auditing button.
3
Select Office 365 (under Applications).
4
Select the template and click Edit to open the auditing wizard.
7
If you are auditing Exchange Online, click Next to update the auditing configuration account password or enter a new auditing configuration account. The account must be a user with the Exchange Administrator role.
8
Click Next to update the events to audit.

All administrative events

All changes made by administrators to the Exchange Online organization.

All mailboxes for non-owner events

By default, only activity performed by users other than the mailbox owner (non-owner activity) are audited. You can however, disable this option and audit only specific mailboxes.

When you disable this option:

Select mailboxes

1
Click Select mailboxes.

Owner events

To optionally add owner auditing on individual mailboxes, enable the Include Owner Activity option.

The "Owner Activity" audited on a configured mailbox include folder, message, and login events.

2
Locate the required mailbox to enable or disable to Include Owner Activity as required.
9
Click Close.
10
Click Next to optionally specify the generic events to exclude from auditing based on their operations. The operations are visible in the "Activity Name/Operation" column of the Office 365 built-in searches. Generic events are dynamically created when associated activity is detected that does not have a corresponding event defined in Change Auditor.
11
Click Finish to apply the updates.

Disable a template

Disabling a template temporarily stops auditing activities without having to remove the template.

Place your cursor in the Status cell for the auditing template to disable, click the arrow control, and select Disabled.
The entry in the Status column for the template changes to ‘Disabled’.
2
To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.
Related Documents