Change Auditor 7.5 - User Guide

Using an existing web application

Using an existing web application

When you create or edit an Microsoft 365 auditing template and you select to use an existing web application it must be configured to support certificate authentication.

NOTE:   • The Microsoft Entra web application should be a single-tenant application. • A redirect URI is not required.

To ensure that you will be able to audit mailbox activity:

•	Upload the certificate for the web application through the Microsoft Entra admin center using App Registration | All Applications | (web application) | Certificates & secrets | Certificate | Upload certificate. The format for the certificate must be binary x.509 (.cer).

•	Add the web application to the Exchange Administrator role for the tenant.

1	In the Microsoft Entra admin center, select Roles and Administrators | All roles.

2	Locate and open the Exchange administrator role.

3	Select Add Assignments.

4	Select No members selected under Select Member(s).

5	Select the required Application (client) ID guid.

6	Save the new member with the Select button and then click Next.

7	Change the Assignment Type to Active, ensure the Permanently assigned option is selected and enter a Justification (required).

8	Click Assign to save the changes and verify that the web application name appears in the Members list for the Exchange Administrator role.

NOTE: Must have a Client Secret configured in the web application "Certificates and Secrets" page.

•	Ensure the required permissions are applied.

NOTE: When creating a web application in the Microsoft Entra admin center, you are required to provide the following URLs: Sign-On URL, App ID URL. Specify any URL address that is unique to your tenant (for example: http://ChangeAuditorApp) for each of them. Once the following permissions are assigned to the web application, click Grant admin consent for and confirm with Yes. Microsoft Graph Application Permissions: • AuditLog.Read.All – Application - Read all audit log data • Directory.Read.All – Application - Read directory data • IdentityRiskEvent.Read.All – Application - Read all identity risk information Office 365 Management APIs Application Permissions: • ActivityFeed.Read – Application - Read activity data for your organization Office 365 Exchange Online Application Permissions: • Exchange.ManageApp - Application - Manage Exchange As Application See Microsoft documentation on assigning API permissions to applications for more details.

Disable a template

Disable a template

Disabling a template temporarily stops auditing activities without having to remove the template.

NOTE: Change Auditor stops collecting events if a license expired, the template is disabled, or the agent stops. After you apply a valid license, enable the template, or restart the agent Change Auditor collects available events from the tenant that were missed.

To disable a template

1	On the Microsoft 365 Auditing page, use one of the following methods to disable an auditing template:

▪	Place your cursor in the Status cell for the auditing template to disable, click the arrow control, and select Disabled.

▪	Right-click the template to disable and select Disable

The entry in the Status column for the template changes to ‘Disabled’.

2	To re-enable the auditing template, use the Enable option in either the Status cell or right-click menu.

Delete a template

Delete a template

NOTE: When you delete a template, the web application created in Microsoft Entra ID remains. You can delete the web application using the Microsoft Entra admin center.

To delete a template

1	On the Microsoft 365 Auditing page, select the template to delete and choose Delete | Delete Template.

2	Click Yes to confirm.

Microsoft 365 Auditing Wizard

Microsoft 365 Auditing Wizard

To audit Microsoft 365 Exchange Online, SharePoint Online, and OneDrive for Business you must first create an auditing template and select an agent. For Exchange Online, you need to also define the type of events to audit.

For details on the integration points and process required to audit an organization, as well as auditing and agent considerations, see Deployment requirements.

Additional notes

•	Microsoft 365 Exchange, SharePoint and OneDrive auditing templates created in the Windows client defaults to 7 days (168 hours) of historical event collection. Historical event collection includes only mailbox auditing types previously enabled.

•	Due to enhanced security measures, basic authentication is no longer supported for Microsoft 365 auditing; certificate authentication is now required.

If you choose to create the required web application when you create the template, you can select to generate a self-signed certificate (default) or use a valid certificate from your personal certificate store. This will result in a properly configured web application.

For a certificate to be valid, it must contain a private key that is marked as exportable, and must support client and server authentication.

If you choose to use an existing web application when you create a template, you will need to specify the application ID, application key, and a valid certificate. For required configuration, see Using an existing web application.

•	The ability to automatically create a new web application is not supported for GCC High tenants.

The following table provides details on how to create a template and the required web application so you can begin to audit Microsoft 365 activity. Also included are the details on how to edit an existing template.

NOTE: Microsoft Exchange, SharePoint and OneDrive auditing templates created in the Windows client defaults to 7 days (168 hours) of historical event collection. Historical event collection includes only mailbox auditing types previously enabled.

 

Table 4. Microsoft 365 Exchange Online Auditing wizard

Page	Description
Service and agent selection page During template creation, use this page to provide the credentials for the accounts that register Change Auditor in the tenant, select the service to audit, and specify the agent.   During editing, use this page to: • Add or remove service to audit. • Update the certificate applied to the web application. NOTE: To select a new agent, you must create a new template or use the Set-CAO365ExchangeTemplate command through PowerShell. (See the Change Auditor PowerShell Command Guide for details.)	If you select to create a new web application: To create a template: 1 Under Authentication Configuration, select to Create a new web application or Use existing web application. If you select to create a new web application: c Select the tenant type (Commercial or GCC). d Enter the Microsoft Entra Directory Name. e Select Generate self-signed certificate or Select certificate to choose a previously created certificate from your personal store. By default, invalid certificates are filtered out from the list of available certificates. If you select to use an existing web application: a Select the tenant type (Commercial, GCC, or GCCHigh). b Enter the Microsoft Entra Directory Name, Application ID, Application key, and select a previously created Application Certificate. For required settings and permissions, see Using an existing web application and Microsoft documentation for details on integrating applications with Microsoft Entra ID, creating a web application, and adding a certificate to a web application.
	3 Select the services to audit. 4 Click Select agent to view available agents and whether they are assigned to a template. The Microsoft 365 cell contains ‘None’ if an agent is not assigned to a template, or ‘Auditing’ if it is assigned to a template. NOTE:   • The agent must be upgraded to version 7.2 for certificate authentication support. • PowerShell 5.1 or later is required. • You cannot use an agent that is already assigned for Microsoft 365 auditing. • GCC and GCCHigh tenants are not supported on agents versions lower than version 7.5. • See the Change Auditor Release Notes for ports that need to be opened on the agent server. 5 If you have selected to audit only SharePoint Online and/or OneDrive for Business activities, click Finish. If you have selected to audit Exchange Online, you need to select the activities to audit within the Exchange Online organization. 6 You will need to login to register Change Auditor in the tenant and ensure the required consent has been granted. Note: Internet access is required. The Microsoft sign-in page opens automatically once you have selected all your template settings and clicked Finish. To grant permission for all administrators to create a web application: a Select an account with the Global Administrator role. b Enter the required password, and select Sign in. c Review the required permissions for the Change Auditor Configuration Assistant on the consent page. (Consent is only required once per tenant. You may, however, be prompted to enter your log on credentials when creating a new web application.) d To apply the consent to all the users in your organization, click to enable Consent on behalf of your organization and click Accept. e To apply the consent for just the current signed-in user simply click Accept.
	To edit a template: 1 Under Authentication Configuration, select to Create a new web application or Use existing web application. If you select to create a new web application, select Generate self-signed certificate or Select certificate to choose a previously created certificate from your personal store. By default, invalid certificates are filtered out from the list of available certificates. If you select to use an existing web application, enter the Application ID, Application Key, and an existing certificate. For required settings and permissions, see Using an existing web application and Microsoft documentation for details on integrating applications with Microsoft Entra ID, creating a web application, and adding a certificate to a web application. 2 Add and remove the services to audit as required. Choose between Exchange Online, SharePoint Online, and OneDrive for Business. When you remove a service, the agent will no longer audit its activity. If you later enable auditing, you will not be able access events generated when auditing was disabled.
Auditing activity selection page Define or edit the types of activity to audit. For a new template, before you can select to audit individual mailboxes or update the configuration to audit owner events, you need to select Finish to create the template. NOTE: When Change Auditor creates a template with default settings, it turns on mailbox non-owner activity auditing settings for every mailbox in your tenant. When you disable this option: ▪ Mailbox non-owner activity auditing settings for every mailbox in your tenant will be disabled as well. ▪ Only the mailboxes specifically added to the template through your selection will be audited. This may affect other systems that rely on having auditing enabled. NOTE: When you add/remove individual mailboxes for auditing or select to enable/disable owner auditing, the changes are saved immediately. They are effective after the agent configuration is updated. NOTE: If you change the mailbox display name, e-mail address, or UPN for a mailbox that is in a template, the auditing of the mailbox continues; however, the old mailbox settings display in the Change Auditor template. To see the new values, remove the mailbox and add it again. IMPORTANT: It is recommended that you select owner auditing for critical mailboxes only. Owner auditing for a large number of mailboxes produces many events that may affect performance.	You can choose from the following: Administrative Activity • All administrative events: This includes remote PowerShell connections to the mailbox, or any action in the web administration portal for the Microsoft 365 Exchange Online organization. Mailbox Activity For mailbox activity, you have the option to set mailbox auditing settings or use the settings that have been configured in the Exchange Online tenant. Set tenant mailbox auditing settings • Select All mailboxes for non-owner events By default, only activities performed by users other than the mailbox owner (non-owner activity) are audited. You can however, disable this option and audit only specific mailboxes. -OR- • Click Select mailboxes. To add a mailbox: a Enter the first letter or letters of the display name (not the mailbox name) in the top search field and click Search. b Select the appropriate entry from the mailbox results and click Add. To remove a mailbox: a Enter the first letter or letters of the display name (not the mailbox name) into the bottom search field and click Search. b Select the appropriate entry from the lower mailbox window and click Remove. You can refine your mailbox search by selecting Non-Owner Only, Owner, or All. (Owner includes mailboxes enabled for both owner and non-owner activity.)
	• To optionally add owner auditing on specific mailboxes, enable the Include Owner Activity option. The "Owner Activity" audited on a configured mailbox include folder, message and login events. a To add or remove owner auditing on specific mailboxes enter the first letter or letters of the display name (not the mailbox name) into the bottom search field and click Search. Locate the required mailbox to enable or disable to Include Owner Activity as required.You can refine your mailbox search by selecting Non-Owner Only, Owner, or All. Use existing tenant mailbox settings When this is enabled, the template settings will have no effect on the mailbox auditing settings. The settings in the tenant will be used. 3 Click Close. 4 Click Next to optionally specify the generic events to exclude from auditing based on their operations. The operations are visible in the "Activity Name/Operation" column of the Microsoft 365 built-in searches. Generic events are dynamically created when associated activity is detected that does not have a corresponding event defined in Change Auditor. 5 Click Finish to apply the updates. When the agent’s configuration is updated, it may take some time (approximately 1 second per mailbox) for it to be applied and the auditing to start after a template is created or modified. 6 You will need to login to register Change Auditor in the tenant and ensure the required consent has been granted. Note: Internet access is required. The Microsoft sign-in page opens automatically once you have selected all your template settings and clicked Finish. To grant permission for all administrators to create a web application: a Select an account with the Global Administrator role. b Enter the required password, and select Sign in. c Review the required permissions for the Change Auditor Configuration Assistant on the consent page. (Consent is only required once per tenant. You may, however, be prompted to enter your log on credentials when creating a new web application.) d To apply the consent to all the users in your organization, click to enable Consent on behalf of your organization and click Accept. e To apply the consent for just the current signed-in user simply click Accept.