Chat now with support
Chat with Support

Change Auditor 7.0.4 - Office 365 and Azure Active Directory User Guide

Office 365 auditing page

The Office 365 auditing page contains a list of auditing templates that define the Office 365 services and Exchange Online mailboxes to audit.

* 
NOTE: Authorization to use the administration tasks on the Administrations Tasks tab is defined using the Application User Interface page under the Configuration task list. If you are denied access to the tasks on this page, see the Change Auditor User Guide for more information about how to gain access.

The following information is displayed for each template:

Template
Displays the name assigned to the auditing template when it was created. This name is the same as your tenant initial domain name.
Status
Indicates whether the auditing template is enabled or disabled.
Enabled templates that are lacking the required permissions for auditing are identified with a warning icon and a status of “Requires update”.
All Administrative Events
Indicates whether all Office 365 Exchange Online administrative events are monitored.
All Non-Owner Events
Indicates whether all Office 365 Exchange Online mailboxes are monitored for activities performed by users other than the mailbox owner.

Create an Office 365 auditing template

The following section describes the steps to create a template and the required web application so you can begin to audit the Office 365 activity.

* 
NOTE: If necessary, you can use an existing web application when you create a template by specifying the web application ID and key.
* 
NOTE: Office 365 Exchange, SharePoint and OneDrive auditing templates created in the Windows client defaults to 7 days (168 hours) of historical event collection. Historical event collection includes only mailbox auditing types previously enabled.
To create a template
1
Open the Administration Tasks page.
2
Click Auditing.
3
Select Office 365 (under Applications).
4
Click Add to open the auditing wizard.
5
To create an Azure web application:
•
Enter the credentials of an Office 365 account in UPN format (for example, <UserName>@<OrganizationName>.<onmicrosoft.com>) with the Global Administrator role. This account is used to create the web application and register Change Auditor in the tenant.
To use an existing Azure web application:
•
Enter the Azure directory, application ID, and application key.
* 
NOTE: If you are using an existing web application, consult the Microsoft documentation. When creating a web application in the Azure Classic Portal, you are required to provide the following URLs: Sign-On URL, App ID URL. Specify any URL address that is unique to your tenant (for example: http://ChangeAuditorApp) for each of them.

Ensure the following permissions are assigned to the Azure web application:

Microsoft Graph application permissions:

•
AuditLog.Read.All – Application - Read all audit log data
•
Directory.Read.All – Application - Read directory data
•
IdentityRiskEvent.Read.All – Application - Read all identity risk information

Office 365 Management APIs application permissions:

•
ActivityFeed.Read – Application - Read activity data for your organization
6
Select the Office 365 services to audit.
7
Click Select agent to view available agents and whether they are assigned to an Office 365 auditing template. The Office 365 cell contains ‘None’ if an agent is not assigned to a template, or ‘Auditing’ if it is assigned to a template. From this list, select the agent to capture the events and click OK.
* 
NOTE: You cannot use an agent that is already assigned for Office 365 auditing.
* 
IMPORTANT: See the Change Auditor Release Notes for ports that must be opened on the agent server.
8
If you have selected to audit Exchange Online, you now must enter the credentials required to configure mailbox auditing settings. Click Next.
a
Under Exchange Online Auditing Configuration, enter the credentials of an Office 365 account in UPN format (for example, <UserName>@<OrganizationName>.<onmicrosoft.com>) with the Exchange Administrator role. You can also select to use the Global Administrator account used to register Change Auditor in the tenant.
b
Click Next to select the activities to audit within the Exchange Online organization.
c
Choose the activities to audit and click Close.
Table 3.  
Available auditing events
Description

All administrative events

All changes made by administrators to the Office 365 Exchange Online organization.

All mailboxes for non-owner events

By default, only activities performed by users other than the mailbox owner (non-owner activity) are audited. You can however, disable this option and audit only specific mailboxes.

NOTE: When Change Auditor creates a template with default settings, it turns on mailbox non-owner activity auditing settings for every mailbox in your tenant.

When you disable this option:

•
Mailbox non-owner activity auditing settings for every mailbox in your tenant are disabled as well.
•
Only the mailboxes specifically added to the template through your selection are audited.
•
This may affect other systems that rely on having auditing enabled.

Select mailboxes

 
NOTE: Before you can select to audit individual mailboxes or update the configuration to audit owner events, select Finish to create the template.
To add and remove individual mailboxes:
1
Click Select mailboxes.
2
To add a mailbox:
a
Enter the first letter or letters of the display name (not the mailbox name) in the top search field and click Search.
b
Select the appropriate entry from the mailbox results and click Add.
3
To remove a mailbox
a
Enter the first letter or letters of the display name (not the mailbox name) into the bottom search field and click Search.
b
Select the appropriate entry from the lower mailbox window and click Remove.
You can refine your mailbox search by selecting Non-Owner Only, Owner, or All. (Owner includes mailboxes enabled for both owner and non-owner activity.)
NOTE: If you change the mailbox display name, email address, or UPN for a mailbox currently in a template, the auditing of the mailbox continues; however, the old mailbox settings display in the Change Auditor template. To see the new values, remove the mailbox and add it again.

Owner events

To optionally add owner auditing on specific mailboxes, enable the Include Owner Activity option.

The "Owner Activity" audited on a configured mailbox include folder, message, and login events.

IMPORTANT: Quest recommends that you select owner auditing for critical mailboxes only. Owner auditing for many mailboxes produces many events that may affect performance.
To add or remove owner auditing on specific mailboxes:
1
Enter the first letter or letters of the display name (not the mailbox name) into the bottom search field and click Search.
2
Locate the required mailbox to enable or disable to Include Owner Activity as required.
You can refine your mailbox search by selecting Non-Owner Only, Owner, or All. (Owner includes mailboxes enabled for both owner and non-owner activity.)
* 
NOTE: When you add and remove individual mailboxes for auditing or select to enable or disable owner auditing, the changes to the template are saved immediately. They are effective after the agent configuration is updated.
9
Click Next to optionally specify the generic events to exclude from auditing based on their operations. The operations are visible in the "Activity Name/Operation" column of the Office 365 built-in searches. Generic events are dynamically created when associated activity is detected that does not have a corresponding event defined in Change Auditor. See Working with generic Office 365 and Azure Active Directory events for more information.
10
Click Finish to create the template.
The template name is automatically set to your tenant initial domain name.
When the agent’s configuration is updated, it may take some time (approximately 1 second per mailbox) for it to be applied and the auditing to start after a template is created or modified.

Edit an Office 365 auditing template

This section describes the steps to add or remove an Office 365 service to audit; update the account used by the agent to maintain Exchange Online auditing configuration; and update the mailboxes and type of Exchange Online events to monitor.

To select a new agent, you must create a new template or use the Set-CAO365Template command through PowerShell. (See the Change Auditor PowerShell Command Guide for details.)

To edit an Office 365 auditing template
1
Open the Administration Tasks page.
2
Click Auditing.
3
Select Office 365 (under Applications).
4
Select the template and click Edit to open the auditing wizard.
5
To create an Azure web application:
•
Enter the credentials of an Office 365 account in UPN format (for example, <UserName>@<OrganizationName>.<onmicrosoft.com>) with the Global Administrator role. This account is used to create the web application and register Change Auditor in the tenant.
To use an existing Azure web application:
•
Enter the Azure directory, application ID, and application key.
* 
NOTE: If you are using an existing web application, consult the Microsoft documentation. When creating a web application in the Azure Classic Portal, you are required to provide the following URLs: Sign-On URL, App ID URL. Specify any URL address that is unique to your tenant (for example: http://ChangeAuditorApp) for each of them.

Ensure the following permissions are assigned to the Azure web application:

Microsoft Graph

Application Permissions:

•
AuditLog.Read.All – Application - Read all audit log data
•
Directory.Read.All – Application - Read directory data
•
IdentityRiskEvent.Read.All – Application - Read all identity risk information

Office 365 Management APIs

Application Permissions:

•
ActivityFeed.Read – Application - Read activity data for your organization
6
Add and remove the services to audit as required. Choose between Exchange Online, SharePoint Online, and OneDrive for Business.
* 
NOTE: When you remove a service, the agent stops auditing its activity. If you later enable auditing, you cannot access events generated when auditing was disabled.
7
If you are auditing Exchange Online, click Next to update the auditing configuration account password or enter a new auditing configuration account. The account must be a user with the Exchange Administrator role.
8
Click Next to update the events to audit.
Table 4. Available activities to audit
Available auditing events
Description

All administrative events

All changes made by administrators to the Exchange Online organization.

All mailboxes for non-owner events

By default, only activity performed by users other than the mailbox owner (non-owner activity) are audited. You can however, disable this option and audit only specific mailboxes.

NOTE: When Change Auditor creates a template with default settings, it turns on mailbox non-owner activity auditing settings for every mailbox in your tenant.

When you disable this option:

•
Mailbox non-owner activity auditing settings for every mailbox in your tenant are disabled as well.
•
Only the mailboxes specifically added to the template through your selection audited.
•
This may affect other are systems that rely on having auditing enabled.

Select mailboxes
To add and remove individual mailboxes:
1
Click Select mailboxes.
2
To add a mailbox:
a
Enter the first letter or letters of the display name (not the mailbox name) in the top search field and click Search.
b
Select the appropriate entry from the mailbox results and click Add.
3
To remove a mailbox
a
Enter the first letter or letters of the display name (not the mailbox name) into the bottom search field and click Search.
b
Select the appropriate entry from the lower mailbox window and click Remove.
You can refine your mailbox search by selecting Non-Owner Only, Owner, or All. (Owner includes mailboxes enabled for both owner and non-owner activity.)
NOTE: If you change the mailbox display name, email address, or UPN for a mailbox currently in a template, the auditing of the mailbox continues; however, the old mailbox settings display in the Change Auditor template. To see the new values, remove the mailbox and add it again.

Owner events

To optionally add owner auditing on individual mailboxes, enable the Include Owner Activity option.

The "Owner Activity" audited on a configured mailbox include folder, message, and login events.

IMPORTANT: Quest recommends that you select owner auditing for critical mailboxes only. Owner auditing for many mailboxes produces many events that may affect performance.
To add or remove owner auditing on individual mailboxes:
1
Enter the first letter or letters of the display name (not the mailbox name) into the bottom search field and click Search.
2
Locate the required mailbox to enable or disable to Include Owner Activity as required.
You can refine your mailbox search by selecting Non-Owner Only, Owner, or All. (Owner includes mailboxes enabled for both owner and non-owner activity.)
* 
NOTE: When you add and remove individual mailboxes for auditing or select to enable or disable owner auditing, the changes to the template are saved immediately. They are effective after the agent configuration is updated.
9
Click Close.
10
Click Next to optionally specify the generic events to exclude from auditing based on their operations. The operations are visible in the "Activity Name/Operation" column of the Office 365 built-in searches. Generic events are dynamically created when associated activity is detected that does not have a corresponding event defined in Change Auditor.
11
Click Finish to apply the updates.
When the agent’s configuration is updated, it may take some time (approximately 1 second per mailbox) for it to be applied and the auditing to start after a template is created or modified.

Disable a template

Disabling a template temporarily stops auditing activities without having to remove the template.

* 
NOTE: Change Auditor stops collecting events if a license expired, the template is disabled, or the agent stops. After you apply a valid license, enable the template, or restart the agent Change Auditor collects available events from the tenant that were missed.
To disable an auditing template
1
On the Office 365 Auditing page, use one of the following methods to disable an auditing template:
•
Place your cursor in the Status cell for the auditing template to disable, click the arrow control, and select Disabled.
•
Right-click the template to disable and select Disable
The entry in the Status column for the template changes to ‘Disabled’.
2
To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating