Change Auditor 7.3 - Office 365 and Azure Active Directory User Guide

Table 6. Available columns
Layout Tab	Search Column Name	Description
Azure - Activity Type	Activity Type	The activity resource type.
Azure - Activity Name/Operation	Activity Name/Operation	The activity that was performed as part of the event.
Azure - Activity Details	Activity Details	Additional information about audited activity. For example, for ‘Self-serve password reset flow activity progress’ it shows what step the user is performing. For sign-in risk events, this shows the status of the risk event, such as "Closed (resolved)".
Azure - Category	Category	The activity category, such as Terms of use, Core Directory, Application Proxy, Account Provisioning, Invited Users, etc.
Azure - Sign-in City	City	The city from which the user signed in or attempted to sign in to an application.
Azure - Sign-in State	State	The state from which the user signed in or attempted to sign in to an application.
Azure - Sign-in Country	Country	The country from which the user signed in or attempted to sign in to an application.


	NOTE: The sign-in columns are only applicable to Azure Active Directory sign-in and sign-in risk events.


	NOTE: For Azure Active Directory sign in events the time detected in the search results references the sign-in time.

Additional information for synchronized environments

When auditing Office 365 and Azure Active Directory in a synchronized environment, you can add columns to display extra mapping information through the search Layout tab:

Table 7. Available columns
Layout Tab	Search Column Name	Description
Azure - Activity Origin	Activity Origin	‘Cloud’ indicates that the event activity was performed directly in the cloud. ‘AD’ indicates that the event activity was originally performed on-premises and was synchronized to the cloud.
Azure - On-premises User	On-premises User	Domain and sAMAccountName of the on-premises user that corresponds to the cloud user that initiated the event.
Azure - On-premises Target	On-premises Target	Domain and sAMAccountName of the on-premises object that corresponds to the cloud object that was the target of the event.
Azure - Target Sync Type	Target Sync Type	‘In Cloud’ indicates that the target object exists only in the cloud ‘Synced from AD’ indicates that the target object was synchronized from Active Directory.
Azure - Target Display Name	Target Display Name	Display the on-premises object display name for synchronized environments or the cloud object display name only for cloud-only objects.
Azure - Tenant Initial Domain	Tenant Initial Domain	Default Azure Active Directory domain name.
Azure - Tenant Display Name	Tenant Display Name	Tenant display name.
Azure - Subject Sync Type	Subject Sync Type	‘SyncedFromAD’ indicates that the subject object was synchronized from Active Directory. ‘In Cloud’ indicates that the subject object exists only in the cloud.
Azure - Subject Display Name	Subject Display Name	Displays the Active Directory on-premises name if a hybrid object and the Azure name if a cloud object.
Azure - On-premises Subject	On-premises Subject	Domain and sAMAccountName of the on-premises object that corresponds to the cloud object that was the subject of the event.
Subject Name	Subject Name	Azure object name regardless of whether a cloud or hybrid object.

In addition to the search columns, the ‘Who’ field shows the mapping information in the event details pane. In cloud only deployments, this field displays the cloud user that initiated the event. If it is a synchronized deployment, the associated on-premises user is displayed after the cloud user in square brackets.

Working with generic Office 365 and Azure Active Directory events

The Azure Active Directory audit reports and the Office 365 audit logs are continuously evolving. To ensure that Change Auditor is synchronized with these updates, generic events have been introduced. Each Azure AD and Office 365 facility in Change Auditor has one generic event defined.

The generic event is generated each time an activity occurs that does not have a corresponding event defined in Change Auditor. For example, “Azure Active Directory - User event” is generated when activities such as “Reset password (self-service)” or “Unlock user account” are performed in Azure Active Directory. Activity information is populated in additional columns and the description for the event (What statement) is dynamically constructed based upon the Azure AD/Office 365 activity and target object name.

When working with these events, you can add additional columns to the search layout to view information about the activity.

Table 8. Available columns

Layout Tab

Search Column Name

Description

Azure - Activity Name/Operation

Activity Name/Operation

Represents the activity that was performed as part of the event.

For sign-in risk events, this shows the risk event type.

Azure - Activity Details

Activity Details

Provides additional information about audited activity.

For example:

•

For ‘Self-serve password reset flow activity progress’, it shows what step the user is performing.

•

For sign-in events it shows why the sign-in failed.

•

For sign-in risk events, this shows the risk event status.

For a complete list of the activities available see the Microsoft support article “Audit activity reports in the Azure Active Directory portal” and “Search the audit log in the Office 365 Security & Compliance Center”.

Additional Office 365 and Azure Active Directory event details

The event details pane contains the following additional information to help gain a better understanding of the activities taking place in Microsoft Office 365 Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory.

Table 9. Event details
Tab	Available information
Overview	Displays a high-level view of the activity that is generated for each event. You can quickly see when the event occurred, who made the change, what changed, where the change originated, the activity, the target type, synchronization type, subject type, subject synchronization type, activity type, category, and action, Additional information for sign-in events include the reason for a sign-in failure and the sign-in location. Additional information for sign-in risk events include the type of risk activity, risk status, risk level, and origin (IP address).
Target (Azure Active Directory events only) NOTE: This tab is not displayed for sign-in and sign-in risk events.	Displays details on the property updates with the old and new value when available. It also displays information about multiple targets affected by a single event. For example, when a user added to a group, you can see both the user and the group as affected targets. When there are multiple targets, the target that best matches the activity type is displayed as the primary target in the Overview tab.
Details	Displays all available properties for a deeper analysis of the activity, including the raw data from the Azure Active Directory Reporting API. For sign-in risk events, it contains raw data from the Azure Active Directory Identity Protection API.
Parameters (Exchange Online Administration events only)	Displays the parameters used to run the Office 365 Administrative command.
Item	Displays Id, rights, SID, Upn, name and path details for Exchange Online permission additions, removals, or modifications.
Additional Info (Azure Active Directory Risky events only)	Displays risk event additional information such as user agent, related event time in UTC, related users agent, device information, related location, request ID, correlation ID.

请选择您的产品：

为向您提供更好的服务，请填写'Purpose of your Chat'（联系目的）：

针对您的问题建议的解决方案

Change Auditor 7.3 - Office 365 and Azure Active Directory User Guide

Displaying additional Azure Active Directory information

Additional information for synchronized environments

Working with generic Office 365 and Azure Active Directory events

Additional Office 365 and Azure Active Directory event details