Chat now with support
Chat with Support

Change Auditor 7.1.1 - Office 365 and Azure Active Directory User Guide

Displaying additional SharePoint Online and OneDrive for Business information

When auditing Office 365, you can add columns to display extra SharePoint Online and OneDrive for Business information through the search Layout tab:

Table 5. Available columns
Layout Tab
Search Column Name
Description

Azure - O365 Site URL

Site Url

The SharePoint Online or OneDrive for Business website URL.

Azure - Activity Name/Operation

Activity Name/Operation

This field matches Operation property in the Office 365 Audit log.

Creating custom Azure Active Directory searches

To create a custom search for all Azure Active Directory events:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New to enable the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
On the What tab, expand Add and click Subsystem | Azure Active Directory.
* 
NOTE: You can use Add with Events | Subsystem | Azure Active Directory to select an existing event from the database and use its properties as a filter for a new search.
6
Select All Events.
7
Select the Layout tab and choose the Azure Active Directory information to include.
8
Click OK to save your selection and close the dialog.
After you have defined the search criteria, you can either save the search definition or run the search.
•
To save the search definition without running it, click Save.
•
To save and run the search, click Run.
To create a custom search for Azure Active Directory events based on facility or event:
1
Open the Searches page.
2
In the explorer view, expand and select the folder where you want to save your search.
3
Click New to enable the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
On the What tab, expand Add. Select Event Class.
6
Group by the Facility column.
•
To add all events within a facility, select the required Azure Active Directory facility, click Add | Add All Events in Facility, and click OK.
OR
•
To add a specific event, select the required event class, click Add | Add This Event, and click OK.
7
Select the Layout tab and choose the Azure Active Directory information to include.
8
After you have defined the search criteria, you can either save the search definition or run the search.
•
To save the search definition without running it, click Save.
•
To save and run the search, click Run.
To create a custom search for Azure Active Directory events based on specific filter options:
1
Open the Searches page.
2
In the explorer view (left pane), expand and select the folder where you want to save your search.
3
Click New to enable the Search Properties tabs across the bottom of the Searches page.
4
On the Info tab, enter a name and description for the search.
5
On the What tab, expand Add and click Subsystem | Azure Active Directory.
* 
NOTE: You can use Add with Events | Subsystem | Azure Active Directory to select an existing event from the database and use its properties as a filter for a new search.
6
Select Selected Events to configure the search.
•
Select the Category filter to specify the event category to include in the search. Select a comparison operator (Like or Not like) and enter a category name. For example, if you are interested only in activities related to self-service password resets, you would choose the “Self-service Password Management” category.
•
Select the Activity Type filter to specify the activity to include in the search. Select a comparison operator (Like or Not like) and enter an activity type. For example, to only show user related activities you would select “User” as the activity type.
•
Select the Activity Name filter to specify the activity to include in the search. (For sign-in risk events, this will show the detected activity that occurred on the risk event.) Select a comparison operator (Like or Not like) and enter an activity name (character string and the * wildcard character). For example: Like *delete* will search for events where Activity contains ‘delete’. For a list of all available activities, see the Microsoft article “Audit activity reports in the Azure Active Directory portal”.
•
Select the Activity Details filter to include activity details in the search. (For sign-in risk events use the status of the risk event, such as Resolved). Select a comparison operator (Like or Not like) and enter a full or partial string (character string and the * wildcard character). For example, the 'Self-serve password reset flow activity progress' activity provides several different details including: User started the mobile SMS verification option, User started the e-mail verification option, or User successfully reset password. You can leave this filter blank to return events for all activities or narrow the search based on the activity details.
•
Select the Target filter to specify the target (primary and secondary targets) to include in the search. (For sign-in risk events, the field searches for the risk event type such as Sign-in from anonymous IP address). Select a comparison operator (Like or Not like) and enter a full or partial name (character string and the * wildcard character). The Target filter searches across the following properties: Object Name (Cloud Target Name), Target Display Name, On-Premises Target, Subject Name, Subject Display Name, and On-Premises Subject.
* 
NOTE: When Azure Active Directory events include multiple targets, Change Auditor identifies these as Target (primary target) and Subject (secondary target).
•
Select the Location filter to specify the country, state, or city to include in the search. Select a comparison operator (Like or Not like) and enter a full or partial name (character string and the * wildcard character).
•
Select the Activity Origin filter to specify the activity origin to include in the search. You can choose between Cloud (event activity was performed directly in the cloud) or AD (event activity was originally performed on-premises and was synchronized to the cloud).
•
Select the Sync Type filter to specify the target (primary and secondary targets) synchronization type to include in the search. You can choose between In Cloud (target object exists only in the cloud) and Synced from AD (target object was synchronized from Active Directory).
* 
NOTE: When Azure Active Directory events include multiple targets, Change Auditor identifies these as Target (primary target) and Subject (secondary target).
7
Click Add to add the expression to the selection list.
8
Repeat this process to add any additional expressions to the search query.
* 
NOTE: When multiple entries are added to the selection list at the bottom of the page, Change Auditor uses the ‘OR’ operator to evaluate events, returning events that meet any of the entries listed.
9
Select the Layout tab and choose the Azure Active Directory information to include.
10
After you have defined the search criteria, you can either save the search definition or run the search.
•
To save the search definition without running it, click Save.
•
To save and run the search, click Run.

Displaying additional Azure Active Directory information

When auditing Azure Active Directory, you can add columns to display extra information through the search Layout tab:

Table 6. Available columns
Layout Tab
Search Column Name
Description

Azure - Activity Type

Activity Type

The activity resource type.

Azure - Activity Name/Operation

Activity Name/Operation

The activity that was performed as part of the event.

Azure - Activity Details

Activity Details

Additional information about audited activity. For example, for ‘Self-serve password reset flow activity progress’ it shows what step the user is performing.

For sign-in risk events, this shows the status of the risk event, such as "Closed (resolved)".

Azure - Category

Category

The activity category, such as Terms of use, Core Directory, Application Proxy, Account Provisioning, Invited Users, etc.

Azure - Sign-in City

City

The city from which the user signed in or attempted to sign in to an application.

Azure - Sign-in State

State

The state from which the user signed in or attempted to sign in to an application.

Azure - Sign-in Country

Country

The country from which the user signed in or attempted to sign in to an application.

* 
NOTE: The sign-in columns are only applicable to Azure Active Directory sign-in and sign-in risk events.
* 
NOTE: For Azure Active Directory sign in events the time detected in the search results references the sign-in time.

 

Additional information for synchronized environments

When auditing Office 365 and Azure Active Directory in a synchronized environment, you can add columns to display extra mapping information through the search Layout tab:

Table 7. Available columns
Layout Tab
Search Column Name
Description

Azure - Activity Origin

Activity Origin

‘Cloud’ indicates that the event activity was performed directly in the cloud.

‘AD’ indicates that the event activity was originally performed on-premises and was synchronized to the cloud.

Azure - On-premises User

On-premises User

Domain and sAMAccountName of the on-premises user that corresponds to the cloud user that initiated the event.

Azure - On-premises Target

On-premises Target

Domain and sAMAccountName of the on-premises object that corresponds to the cloud object that was the target of the event.

Azure - Target Sync Type

Target Sync Type

‘In Cloud’ indicates that the target object exists only in the cloud

‘Synced from AD’ indicates that the target object was synchronized from Active Directory.

Azure - Target Display Name

Target Display Name

Display the on-premises object display name for synchronized environments or the cloud object display name only for cloud-only objects.

Azure - Tenant Initial Domain

Tenant Initial Domain

Default Azure Active Directory domain name.

Azure - Tenant Display Name

Tenant Display Name

Tenant display name.

Azure - Subject Sync Type

Subject Sync Type

‘SyncedFromAD’ indicates that the subject object was synchronized from Active Directory.

‘In Cloud’ indicates that the subject object exists only in the cloud.

Azure - Subject Display Name

Subject Display Name

Displays the Active Directory on-premises name if a hybrid object and the Azure name if a cloud object.

Azure - On-premises Subject

On-premises Subject

Domain and sAMAccountName of the on-premises object that corresponds to the cloud object that was the subject of the event.

Subject Name

Subject Name

Azure object name regardless of whether a cloud or hybrid object.

In addition to the search columns, the ‘Who’ field shows the mapping information in the event details pane. In cloud only deployments, this field displays the cloud user that initiated the event. If it is a synchronized deployment, the associated on-premises user is displayed after the cloud user in square brackets.

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating