Chat now with support
Chat with Support

Change Auditor 7.6 - Microsoft 365 and Microsoft Entra ID Auditing User Guide

Microsoft 365 and Microsoft Entra ID Auditing Overview Configuring Microsoft 365 and Microsoft Entra ID auditing Reports and Searches

Introduction to Microsoft 365 and Microsoft Entra ID reporting

Change Auditor delivers both preconfigured and customizable reports displaying events in one centralized viewer. You can create custom search definitions to locate changes made in Microsoft 365 and Microsoft Entra ID. Using the available search properties across the bottom of the Searches page, you can define the search criteria and include specific columns to access more tenant details.

When Change Auditor is deployed in a synchronized environment, you can add extra columns to display extra mapping information about synchronized Active Directory users and their cloud identities for Microsoft 365 and Microsoft Entra events. For details, see Auditing in synchronized environments.

Microsoft 365 built-in reports

Microsoft 365 built-in reports

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

To view all Microsoft 365 searches:
1
Start the client and open the Searches tab.
2
In the explorer view (left pane), expand the Shared | Built-in | Microsoft 365 folder.
3
Locate and double-click the required search in the right pane.

Microsoft Entra built-in reports

Microsoft Entra built-in reports

To see a complete list of built-in reports, see the Change Auditor Built-in Reports Reference Guide.

To view all Microsoft Entra searches:
1
Start the client and open the Searches tab.
2
In the explorer view (left pane), expand the Shared | Built-in | Microsoft Entra folder.
3
Locate and double-click the required search in the right pane.

Custom searches

You can create custom searches to meet your specific needs by using the following search properties tabs to define the criteria:

•
What - allows you to search for events generated in a specific subsystem
•
Who - allows you to search for events generated by a specific user
•
Where - allows you to search for events captured by a specific agent
•
When - allows you to search for events that occurred within a specific date and time range

 

* 
NOTE: Selecting the Private folder creates a search that only you can run and view, whereas selecting the Shared folder creates a search that all users can view and run.

The following examples show how to use searches to find the information you need.

•
Creating custom Exchange Online searches
•
Creating a custom SharePoint Online and OneDrive for Business search
•
Creating custom Microsoft Entra searches
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating