Change Auditor 7.1

Table 7. Office 365 OneDrive for Business file events
Event	Description
File accessed in OneDrive for Business	Created when a user or system account accesses a file in a OneDrive for Business site.
File checked in in OneDrive for Business	Created when a user checks in a file to a document library.
File checked out and discarded in OneDrive for Business	Created when a file check out is undone resulting in no edits to the file in the document library.
File checked out in OneDrive for Business	Created when a user checks out a file from a document library.
File copied in OneDrive for Business	Created when a file is copied from a OneDrive for Business site.
File deleted in OneDrive for Business	Created when a file is deleted from a OneDrive for Business site.
File downloaded in OneDrive for Business	Created when a file is downloaded from a OneDrive for Business site.
File modified in OneDrive for Business	Created when file contents or properties are changed by a user or system account in a OneDrive for Business site.
File moved in OneDrive for Business	Created when a file is moved in a OneDrive for Business site.
File previewed in OneDrive for Business	Created when a file is viewed by a user or system account in a OneDrive for Business site.
File renamed in OneDrive for Business	Created when a file is renamed in a OneDrive for Business site.
File restored in OneDrive for Business	Created when a deleted file is restored in a OneDrive for Business site.
File uploaded in OneDrive for Business	Created when a file is uploaded to a OneDrive for Business site.

Table 8. Office 365 OneDrive for Business folder events
Event	Description
Folder accessed in OneDrive for Business	Created when a user or system account accesses a folder in a OneDrive for Business site.
Folder created in OneDrive for Business	Created when a folder is created in a OneDrive for Business site.
Folder deleted in OneDrive for Business	Created when a folder is deleted from a OneDrive for Business site.
Folder modified in OneDrive for Business	Created when a folder property is changed in a OneDrive for Business site.
Folder moved in OneDrive for Business	Created when a folder is moved in a OneDrive for Business site.
Folder renamed in OneDrive for Business	Created when a folder is renamed in a OneDrive for Business site.

Table 9. Office 365 OneDrive for Business Uncategorized event
Event	Description
Uncategorized Office 365 OneDrive for Business audit event	Created when OneDrive for Business activity is detected that is not included in existing Change Auditor events.

Additional internal events and built-in reports

The following internal events have been added to help you detect auditing issues and to identify changes made to your templates:

Table 10. New events
Event	This event is triggered when....
Office 365 auditing template added	Created when an Office 365 auditing template is added to Change Auditor.
Office 365 auditing template agent changed	Created when the agent for an existing Office 365 auditing template is changed. The event details include the old and new agent FQDN.
Office 365 auditing template disabled	Created when an Office 365 auditing template is disabled.
Office 365 auditing template enabled	Created when an Office 365 auditing template is enabled.
Office 365 auditing template removed	Created when an Office 365 auditing template is removed from Change Auditor.
Office 365 auditing web application changed	Created when the web application is changed for an existing Office 365 template. The event details display the old and new web application ID GUID. NOTE: An Office 365 auditing web application key change event is also generated since the key is a property of the web application.
Office 365 auditing web application key changed	Created when the web application key is changed for an existing Office 365 template.
Office 365 OneDrive for Business auditing disabled	Created when OneDrive for Business is disabled in an Office 365 auditing template.
Office 365 OneDrive for Business auditing enabled	Created when OneDrive for Business is enabled in an Office 365 auditing template.
Office 365 SharePoint Online auditing disabled	Created when SharePoint Online is disabled in an Office 365 auditing template.
Office 365 SharePoint Online auditing enabled	Created when SharePoint Online is enabled in an Office 365 auditing template.

The following built-in reports have been added to help you quickly get a sense of the Office 365 activity within your organization and sites:


	NOTE: Office 365 — Operation and Office 365 Site URL columns are now available to include as layout options to help you access information quickly.

•

All Office 365 events in the past 7 days

•

All Office 365 Exchange Online events in the past 7 days

•

All Office 365 OneDrive for Business events in the past 7 days

•

All Office 365 OneDrive for Business events in the past 7 days grouped by operation

•

Office 365 OneDrive for Business file activity events in the past 7 days

•

Office 365 OneDrive for Business folder activity events in the past 7 days

•

All Office 365 SharePoint Online events in the past 7 days

•

All Office 365 SharePoint Online events in the past 7 days grouped by operation

•

Office 365 SharePoint Online file activity events in the past 7 days

•

Office 365 SharePoint Online folder activity events in the past 7 days

Updated Office 365 PowerShell commands

The PowerShell commands have been updated to allow you to manage auditing of the supported Office 365 services.

•

New-CAO365Template

Use this command to create a template for auditing Office 365 Exchange Online, SharePoint Online, and OneDrive for Business.

•

Set-CAO365Template

Use this command to edit the account used to access Office 365 Exchange Online, the type of service and events to audit, and select a new agent.

•

Get-CAO365Templates

Use this command to see all the Office 365 templates available within your installation.

New Azure Active Directory events

The following events have been added.

Table 11. Azure Active Directory User events
Event	This event is triggered when....
User AccountEnabled property changed	Created when a user’s sign-in status is changed. (Administrators can set the status to allowed and blocked.)
User AssignedPlan property changed	Created when a user’s service plan and application are changed as a result of a license change.
User AssignedLicense property changed	Created when a user’s product licenses has been edited. (Administrators can assign, reassign, or remove licenses as required.)
User license changed	Created when the license assigned to a user in the directory is changed.
User Mobile property changed	Created when a user’s mobile phone number is changed.
User OtherMail property changed	Created when a user's alternate email address is changed.
User OtherMobile property changed	Created when a user's alternate mobile phone number is changed.
User TelephoneNumber property changed	Created when a user's telephone number is changed.
User StrongAuthenticationMethod property changed	Created when the multi-factor authentication for verification method has been changed for a user. Available methods include call to phone, text message to phone, notification through mobile application, and verification code from mobile application.
User StrongAuthenticationUserDetail property changed	Created when a user’s phone number, alternative phone number, or email address used for multi-factor authentication and password reset verification have been changed.
User StrongAuthenticationRequirement property changed	Created when multi-factor authentication is enforced, enabled, or disabled for a user. Turning on multi-factor authentication changes the state to enabled. The state changes to enforced when the user signs in and authenticates.