Change Auditor 7.2 - Office 365 and Azure Active Directory User Guide


	NOTE: You can use Add with Events \| Subsystem \| Office 365 (instead of Add \| Subsystem \| Office 365) to search for events associated with an online mailbox or administrative action that already has an event associated with it.

Choose the Selected Events option to configure the search.


	NOTE: When multiple entries are added to the selection list at the bottom of the page, Change Auditor uses the ‘OR’ operator to evaluate events, returning events that meet any of the entries listed.

Select the Mailbox Event option.

Procedure

To search for activities performed on a specific mailbox

Select Mailbox Name to specify the mailbox to include.

Select the comparison operator to use: Contains or Does Not Contain. Enter the pattern (character string) to be used to search for a match. For example: Contains admin finds all events for mailboxes that contain ‘admin’ anywhere in their name.

Click Add to add the expression to the selection list at the bottom of the page.

Repeat this process to add any additional mailboxes to the search query.

To search for all activities performed on a specific folder and its contents across all monitored mailboxes

Select Folder Name to specify the folder to include.

Select the comparison operator to use: Contains or Does Not Contain. Enter the pattern (character string) to be used to search for a match. For example: Contains Inbox finds all events in ‘Inbox’ folder across all audited mailboxes.

Click Add to add the expression to the selection list at the bottom of the page.

Repeat this process to add any additional folders to the search query.

To search for all activities by specific synchronized accounts based on their on-premises account name

Select On-Premises User Name to specify the user to include.

Select the comparison operator to use: Like or Not Like. Enter the pattern (character string and * wildcard character) to be used to search for a match. For example: Like *admin* finds all events performed by accounts that were synchronized from on-premises Active Directory that contain ‘admin’ anywhere in their sAMAccountName attribute.

Click Add to add the expression to the selection list.

Repeat this process to add any additional users to the search query.

NOTE: For this search to function, the Azure Active Directory must have been synchronized with the on-premises environment using Azure Active Directory Connect. For details, see Auditing in synchronized environments.

To search for all activities performed on synchronized mailboxes based on their on-premises account name

Select On-Premises Target Name to specify the user to include. Use this format domain\username.

Select the comparison operator to use: Like or Not Like. Enter the pattern (character string and * wildcard character) to be used to search for a match. For example: Like *admin* finds all events performed on synchronized mailboxes that have ‘admin’ anywhere in their on-premises sAMAccountName attribute.

Click Add to add the expression to the selection list.

Repeat this process to add any additional mailboxes to the search query.

To search for activities performed on specific mailboxes based on their mailbox display name

Select Target Display Name to specify the mailbox to include.

Select the comparison operator to use: Like or Not Like. Enter the pattern (character string and * wildcard character) to be used to search for a match. For example: Like *admin* finds all events for mailboxes that contain ‘admin’ anywhere in their mailbox display name.

Click Add to add the expression to the selection list.

Repeat this process to add any additional mailboxes to the search query.

To search for activities performed on specific mailboxes based on their synchronization status

Select Target Sync Type to specify the type of mailbox accounts to include based on how they are synchronized.

Select In cloud to include mailboxes existing only in the cloud.

Select Synced from AD to include mailboxes that have been synchronized from on-premises Active Directory.

Click Add to add the expression to the selection list.

To search for Administration cmdlets that were run:

On the What tab, expand Add and click Subsystem | Office 365.

On the Office 365 Exchange Online dialog, choose the Selected Events option to configure the search.

Select the Administration Cmdlet Event option.

•

Click Cmdlet Name and select the comparison operator to use: Contains or Does not contain. Enter the ‘command’ to use to search for a match. For example, to search for any ‘add’ users, enter add.

•

Click Cmdlet Parameters select the comparison operator to use (Contains or Does not contain), and enter the name (or partial name) of a parameter to use to search for a match.

•

Click Parameter Values select the comparison operator to use (Contains or Does not contain), and enter the value to use to search for a match.

•

Click Cmdlet Object, select the comparison operator to use (Contains or Does not contain), and enter the name (or partial name) of a mailbox to use to search for a match.

NOTE:

•

If the Cmdlet Name, Cmdlet Parameters, Parameter Values and Cmdlet Object are specified, all expressions must be met before an event is returned

•

Cmdlet Parameters and Parameter Values can be searched separately; however, when both are selected the query is limited to the parameter that contains the selected value.

To add the expression to the selection list, click Add.

Repeat this process to add any additional search query requirements.


	NOTE: When multiple entries are added to the selection list at the bottom of the page, Change Auditor uses the ‘OR’ operator to evaluate events, returning events that meet any of the entries listed.

Creating a custom SharePoint Online and OneDrive for Business search

To create a custom SharePoint Online and OneDrive for Business search:

Open the Searches page.

In the explorer view (left pane), expand and select the folder where you want to save your search.

Click New to enable the Search Properties tabs across the bottom of the Searches page.

On the Info tab, enter a name and description for the search.

On the What tab, expand Add and click Subsystem | Office 365.

Choose the Selected Events option to configure the search.

Select SharePoint/OneDrive Events.

Select a service from the Office 365 services filter to include in the search. You can choose SharePoint Online, OneDrive for Business, or both. If no additional filters are set, all events for the selected services are returned. You can specify additional filters as follows:

•

Select the Operation filter to specify the operation to include in the search. Select a comparison operator (Like or Not like) and enter an operation name (character string and the * wildcard character). For example: Like *delete* will search for events where Operation contains ‘delete’. For a list of all available operations, see the Microsoft support article “Search the audit log in the Office 365 Security & Compliance Center”.

•

Select Site URL filter to specify the full or partial URL to include in the search. Select a comparison operator (Like or Not like) and enter a string (character string and the * wildcard character).

•

Select the Target filter to specify the full or partial name of the operation target (for example, the folder, file, user, or group) to include in the search. Select a comparison operator (Like or Not like) and enter a string (character string and the * wildcard character). This search field corresponds to the contents of the Object Name column in the results grid.

Click Add to add the expression to the selection list.

Repeat this process to add any additional conditions to the search query.


	NOTE: When multiple entries are added to the selection list at the bottom of the page, Change Auditor uses the ‘OR’ operator to evaluate events, returning events that meet any of the entries listed.

Displaying additional SharePoint Online and OneDrive for Business information

When auditing Office 365, you can add columns to display extra SharePoint Online and OneDrive for Business information through the search Layout tab:

Table 5. Available columns
Layout Tab	Search Column Name	Description
Azure - O365 Site URL	Site Url	The SharePoint Online or OneDrive for Business website URL.
Azure - Activity Name/Operation	Activity Name/Operation	This field matches Operation property in the Office 365 Audit log.

Creating custom Azure Active Directory searches

To create a custom search for all Azure Active Directory events:

Open the Searches page.

In the explorer view (left pane), expand and select the folder where you want to save your search.

Click New to enable the Search Properties tabs across the bottom of the Searches page.

On the Info tab, enter a name and description for the search.

On the What tab, expand Add and click Subsystem | Azure Active Directory.


	NOTE: You can use Add with Events \| Subsystem \| Azure Active Directory to select an existing event from the database and use its properties as a filter for a new search.

Select All Events.

Select the Layout tab and choose the Azure Active Directory information to include.

Click OK to save your selection and close the dialog.

After you have defined the search criteria, you can either save the search definition or run the search.

•

To save the search definition without running it, click Save.

•

To save and run the search, click Run.

To create a custom search for Azure Active Directory events based on facility or event:

Open the Searches page.

In the explorer view, expand and select the folder where you want to save your search.

Click New to enable the Search Properties tabs across the bottom of the Searches page.

On the Info tab, enter a name and description for the search.

On the What tab, expand Add. Select Event Class.

Group by the Facility column.

•

To add all events within a facility, select the required Azure Active Directory facility, click Add | Add All Events in Facility, and click OK.

•

To add a specific event, select the required event class, click Add | Add This Event, and click OK.

Select the Layout tab and choose the Azure Active Directory information to include.

After you have defined the search criteria, you can either save the search definition or run the search.

•

To save the search definition without running it, click Save.

•

To save and run the search, click Run.

To create a custom search for Azure Active Directory events based on specific filter options:

Open the Searches page.

In the explorer view (left pane), expand and select the folder where you want to save your search.

Click New to enable the Search Properties tabs across the bottom of the Searches page.

On the Info tab, enter a name and description for the search.

On the What tab, expand Add and click Subsystem | Azure Active Directory.


	NOTE: You can use Add with Events \| Subsystem \| Azure Active Directory to select an existing event from the database and use its properties as a filter for a new search.

Select Selected Events to configure the search.

•

Select the Category filter to specify the event category to include in the search. Select a comparison operator (Like or Not like) and enter a category name. For example, if you are interested only in activities related to self-service password resets, you would choose the “Self-service Password Management” category.

•

Select the Activity Type filter to specify the activity to include in the search. Select a comparison operator (Like or Not like) and enter an activity type. For example, to only show user related activities you would select “User” as the activity type.

•

Select the Activity Name filter to specify the activity to include in the search. (For sign-in risk events, this will show the detected activity that occurred on the risk event.) Select a comparison operator (Like or Not like) and enter an activity name (character string and the * wildcard character). For example: Like *delete* will search for events where Activity contains ‘delete’. For a list of all available activities, see the Microsoft article “Audit activity reports in the Azure Active Directory portal”.

•

Select the Activity Details filter to include activity details in the search. (For sign-in risk events use the status of the risk event, such as Resolved). Select a comparison operator (Like or Not like) and enter a full or partial string (character string and the * wildcard character). For example, the 'Self-serve password reset flow activity progress' activity provides several different details including: User started the mobile SMS verification option, User started the e-mail verification option, or User successfully reset password. You can leave this filter blank to return events for all activities or narrow the search based on the activity details.

•

Select the Target filter to specify the target (primary and secondary targets) to include in the search. (For sign-in risk events, the field searches for the risk event type such as Sign-in from anonymous IP address). Select a comparison operator (Like or Not like) and enter a full or partial name (character string and the * wildcard character). The Target filter searches across the following properties: Object Name (Cloud Target Name), Target Display Name, On-Premises Target, Subject Name, Subject Display Name, and On-Premises Subject.


	NOTE: When Azure Active Directory events include multiple targets, Change Auditor identifies these as Target (primary target) and Subject (secondary target).

•

Select the Location filter to specify the country, state, or city to include in the search. Select a comparison operator (Like or Not like) and enter a full or partial name (character string and the * wildcard character).

•

Select the Activity Origin filter to specify the activity origin to include in the search. You can choose between Cloud (event activity was performed directly in the cloud) or AD (event activity was originally performed on-premises and was synchronized to the cloud).

•

Select the Sync Type filter to specify the target (primary and secondary targets) synchronization type to include in the search. You can choose between In Cloud (target object exists only in the cloud) and Synced from AD (target object was synchronized from Active Directory).


	NOTE: When Azure Active Directory events include multiple targets, Change Auditor identifies these as Target (primary target) and Subject (secondary target).

Click Add to add the expression to the selection list.

Repeat this process to add any additional expressions to the search query.


	NOTE: When multiple entries are added to the selection list at the bottom of the page, Change Auditor uses the ‘OR’ operator to evaluate events, returning events that meet any of the entries listed.

Select the Layout tab and choose the Azure Active Directory information to include.

After you have defined the search criteria, you can either save the search definition or run the search.

•

To save the search definition without running it, click Save.

•

To save and run the search, click Run.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Change Auditor 7.2 - Office 365 and Azure Active Directory User Guide

Creating custom Exchange Online searches

Creating a custom SharePoint Online and OneDrive for Business search

Displaying additional SharePoint Online and OneDrive for Business information

Creating custom Azure Active Directory searches