Chat now with support
Chat with Support

Change Auditor 7.1.1 - Office 365 and Azure Active Directory User Guide

Edit an Azure Active Directory auditing template

This section describes how to add or remove Azure Active Directory activity to audit.

To select a new agent, you must create a new template or use the Set-CAAzureADTemplate command through PowerShell. (See the Change Auditor PowerShell Command Guide for details.)

To edit an Azure Active Directory auditing template
1
Open the Administration Tasks page.
2
Click Auditing button.
3
Select Azure Active Directory (under Applications).
4
Select the template and click Edit to open the auditing wizard.
5
To create an Azure web application:
•
Enter the credentials of an Office 365 account in UPN format (for example, <UserName>@<OrganizationName>.<onmicrosoft.com>) with the Global Administrator role. This account is used to create the web application and register Change Auditor in the tenant.
To use an existing Azure web application:
•
Enter the Azure directory, application ID, and application key.
* 
NOTE: If you are using an existing web application, consult the Microsoft documentation. When creating a web application in the Azure Classic Portal, you are required to provide the following URLs: Sign-On URL, App ID URL. Specify any URL address that is unique to your tenant (for example: http://ChangeAuditorApp) for each of them.

Ensure the following permissions are assigned to the Azure web application:

Microsoft Graph application permissions:

•
AuditLog.Read.All – Application - Read all audit log data
•
Directory.Read.All – Application - Read directory data
•
IdentityRiskEvent.Read.All – Application - Read all identity risk information

Office 365 Management APIs application Permissions:

•
ActivityFeed.Read – Application - Read activity data for your organization
6
Add and remove the activity to audit as required.
•
Audit Logs audits Azure Active Directory user, group, application, and directory activity. A Change Auditor for Active Directory license is required.
•
Sign-ins: Audits Azure Active Directory user sign-in and sign-in risk event activity. A Change Auditor for Logon Activity User license is required.
7
Click Finish to apply the updates.

Disable a template

Disabling a template temporarily stops auditing activities without having to remove the template.

* 
NOTE: Change Auditor stops collecting events if a license expired, the template is disabled, or the agent stops. After you apply a valid license, enable the template, or restart the agent Change Auditor collects available events from the tenant that were missed.
To disable an auditing template
1
On the Azure Active Directory Auditing page, use one of the following methods to disable an auditing template:
•
Place your cursor in the Status cell for the auditing template to disable, click the arrow control, and select Disabled.
•
Right-click the template to disable and select Disable
The entry in the Status column for the template changes to ‘Disabled’.
2
To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.

Delete a template

* 
NOTE: When you delete a template, the web application created in Azure Active Directory remains. You can delete the web application using the Azure management portal.
To delete a template
1
On the Azure Active Directory Auditing page, select the template to delete and choose Delete | Delete Template.
2
Click Yes to confirm.

Considerations

•
If you have a synchronized environment, you may be auditing high volume synchronization events which have low value. To improve performance and reduce the number of events stored in the database, consider excluding some events with an excluded account template that targets the synchronization account and high volume Azure Active Directory events. Alternatively, you can select to purge the events after a specified number of days. If you set up a purge job for these events, ensure to configure the purge settings to delete the events before they are subject to any archival settings.
•
Ensure that the appropriate Change Auditor licenses have been applied on all coordinators. See License requirements for license requirements.
•
Ensure that the appropriate Azure Active Directory license has been applied:
•
To audit sign-in events, an Azure Premium P1 license is required.
•
To audit risk events, an Azure Premium P2 license is required.
•
Ensure that the following permissions have been applied on the Azure web application that is associated with your template.
Microsoft Graph application permissions:
•
AuditLog.Read.All – Application - Read all audit log data
•
Directory.Read.All – Application - Read directory data
•
IdentityRiskEvent.Read.All – Application - Read all identity risk information
Office 365 Management APIs application permissions:
•
ActivityFeed.Read – Application - Read activity data for your organization
Once the required permissions are applied, click Grant admin consent for… and confirm with Yes.
•
Because Change Auditor collects Microsoft's audit logs, the events and details reported are limited to what these logs provide. If an event appears to be missing in Change Auditor, log onto the respective portal and review the audit logs to see if the event is listed.
•
For Azure Active Directory activity check the Audit Logs under Monitoring | Audit logs or go to https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Audit.
•
For Azure Active Directory Sign-ins check the Sign-ins under Monitoring | Sign-ins or go to https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/SignIns
•
For Azure Active Directory Risky sign-ins check the Risky sign-ins under Manage | Security | Risky sign-ins or go to https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/SecurityMenuBlade/RiskySignIns.
•
For Office 365 activity check the Audit Log under Search | Audit log search or go to https://protection.office.com/unifiedauditlog.
•
See if the following internal events, which are in place to monitor the status of Azure Active Directory and Office 365 auditing, have been generated. Persistent suspension of the auditing where auditing does not resume may lead to delayed event processing that requires administrator attention.
•
Azure Active Directory auditing has suspended
Event generated when auditing is active, and then client or server HTTP error codes (4xx or 5xx *) are returned by the Azure Active Directory auditing service.
•
Azure Active Directory auditing has resumed
Event generated when auditing was in a suspended state, and then a successful HTTP code is returned by the Azure Active Directory auditing service.
•
Office 365 auditing has suspended
Event generated when auditing is active, and then client or server HTTP error codes (4xx or 5xx *) are returned by the Office 365 auditing service.
•
Office 365 auditing has resumed
Event generated when Office 365 auditing was in a suspended state, and then a successful HTTP code is returned by the Office 365 auditing service.
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating