Chat now with support
Chat with Support

Change Auditor 7.4 - Office 365 and Azure Active Directory User Guide

Office 365 and Azure Active Directory Auditing Overview Configuring Office 365 and Azure Active Directory auditing Reports and Searches

Deployment requirements

Deployment requirements

To successfully audit and report on events, ensure that your environment meets the minimum system requirements and you have reviewed the deployment information.

•
System requirements
•
License requirements
•
Auditing and agent considerations
•
Auditing in synchronized environments
•
Upgrading Change Auditor

System requirements

For information about system requirements, see the Change Auditor Release Notes. For details on installing Change Auditor, see the Change Auditor Installation Guide.

License requirements

Change Auditor stops collecting events if a license expires. After you apply a license, the agent collects available events from the tenant that were missed. The Office 365 and Azure Active Directory events are retained in the tenant for a specific period depending on your subscription type. If this period elapses before a new license is applied, some events are lost.

Table 2. License requirement
Auditing option
License requirement

Exchange Online

Change Auditor for Exchange

SharePoint Online

OneDrive for Business

Change Auditor for SharePoint

 

Azure Active Directory

Change Auditor for Active Directory

Azure Active Directory sign-ins

Azure Active Directory sign-in risk event

Change Auditor for Logon Activity User

* 
NOTE: To verify that it is licensed, right-click the coordinator icon in the system tray and select Licensing.

Auditing and agent considerations

When auditing Office 365 and Azure Active Directory, keep the following in mind:

•
Occasionally duplicate auditing events are produced. This can occur when a service disruption requires that Microsoft administrators replay database transaction files to ensure that no events are lost. Change Auditor removes duplicated events that come in at the same time, but if an event that has already been sent to our database is sent again from Office 365 it is displayed as a duplicate.
•
By default. auditing settings that have been previously configured in the tenant for Exchange Online by third-party software are overwritten by the auditing setting specified in the Office 365 template when the configuration is applied. You can, however, select to not overwrite the tenant settings.
•
Change Auditor collects Microsoft's audit logs, and as a result the events and details reported are limited to what these logs provide.
•
Change Auditor checks for new Azure Active Directory events every 15 minutes and for new Office 365 events every 5 minutes.
•
You can create multiple Azure Active Directory or Office 365 templates to monitor multiple tenants; however, you must select a different agent for each template. A single agent cannot monitor multiple tenants. A single agent can audit both Azure Active Directory and Office 365 against the same tenant.
•
If your organization uses a proxy server to connect to the internet, you must configure the Proxy Server settings on the Agent Configuration page to audit Azure Active Directory and Office 365 targets.
•
The following URLs must be accessible for cloud auditing to be fully functional:
•
https://login.microsoftonline.com
•
https://graph.microsoft.com
•
https://manage.office.com
•
https://outlook.office365.com/powershell-liveid/
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating