立即与支持人员聊天
与支持团队交流

Change Auditor 7.5 - Release Notes

Microsoft 365 auditing

Microsoft 365 auditing
Table 32. Microsoft 365 auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Exchange

Change Auditor for SharePoint

Microsoft 365 subscriptions

Change Auditor can audit the various Microsoft 365 plans offered by Microsoft including business and enterprise subscriptions.

Windows PowerShell

Windows PowerShell version 5.1 on the computer where the agent is installed.

URLs

The agent configured to monitor Microsoft 365 must be able to access the following URLs:

•
https://login.microsoftonline.com
•
https://manage.office.com
•
https://outlook.office365.com/powershell-liveid
•
https://graph.microsoft.com

Ports

•
A firewall outbound exception for remote port 443 (https) must exist for every agent computer used for Microsoft 365 auditing. Port 443 is used for communicating with the Microsoft cloud.
•
If an agent is separated from the coordinator by a firewall, you must create a firewall exception for port 8373 on every agent computer to be used for Microsoft 365 or Microsoft Entra ID auditing. Port 8373 is the default port that enables the coordinator to communicate with the agent. A different port number can, however, be specified by running Set-CAConfiguration command. For details, see the Change Auditor PowerShell Command Guide.

Required rights and permissions

•
When creating an Microsoft 365 or Microsoft Entra ID auditing template that requires Microsoft Entra web application creation the user will be prompted to log in with Microsoft Entra administrator credentials.

For more information

See the Microsoft 365 and Microsoft Entra ID Auditing User Guide.

Microsoft Entra ID auditing

Microsoft Entra ID auditing
Table 33. Microsoft Entra ID auditing requirements
Component
Supported versions

Change Auditor

Change Auditor for Active Directory

Microsoft Entra ID

Change Auditor can audit the Microsoft Entra ID that is included with an Microsoft 365 subscription or the Microsoft Entra ID Basic subscription.

URLs

The agent configured to monitor Microsoft Entra ID must be able to access the following URLs:

•
https://login.microsoftonline.com
•
https://graph.microsoft.com

Ports

•
443 (HTTPS) — for the agent to connect to the Microsoft Entra ID.
•
8373 — for the Change Auditor coordinator service to connect to the agent computer.

Required rights and permissions

•
When creating an auditing template that requires Microsoft Entra web application creation, the user is prompted to log in with Microsoft Entra administrator credentials.

Synchronized environments

When auditing Microsoft Entra ID in a synchronized environment, Change Auditor provides more event details by mapping identities from on-premises directories with Microsoft Entra ID.

The following conditions must be met for Change Auditor to perform the mapping:

•
Synchronization performed with Microsoft Entra Connect.
•
Microsoft Entra Connect synchronization process is active in your on-premises environment and directory sync is active in your cloud environment.
•
A Microsoft Entra template has been created to audit your online environment that is being synchronized with on-premises Active Directory.
•
The agent that is specified in the auditing template, must be a member server of the forest that is being synchronized with Microsoft Entra ID.

When Federation with AD FS is used as the single sign-on method, Microsoft Entra logon events will no longer be generated since the authentication is done by the on-premises AD FS instance.

For more information

See the Change Auditor for Active Directory User Guide.

Product licensing

If you need a new license key, refer to the License Key Upgrade page.

You will need the license number from each license that is applied. To get this information, select the license in the License Manager and choose Details.

If you purchased multiple Change Auditor products, you only need one instance of the Change Auditor product. The license keys determine what features are enabled and disabled in the product.

The following products require separate licenses which can be applied during the coordinator installation process:

•
Change Auditor for Active Directory
•
Change Auditor for Active Directory Queries
•
Change Auditor for EMC
•
Change Auditor for Exchange
•
Change Auditor for Logon Activity User (to capture logon activity from server agents)
•
Change Auditor for Logon Activity Workstation (to capture logon activity from workstation agents)
•
Change Auditor for NetApp
•
Change Auditor for SharePoint
•
Change Auditor for SQL Server
•
Change Auditor for Windows File Servers

If you are licensing multiple Change Auditor products, you can apply the licenses in any order but must apply all the licenses provided.

To enable a trial or purchased commercial license:
1
Copy the Change Auditor license files to your desktop, or other convenient location.
2
If you have not installed the Change Auditor components, browse to the folder where the Change Auditor package was downloaded, and run the Quest Change Auditor Coordinator (x64).msi file to open the Change Auditor Coordinator Setup wizard.
3
During the coordinator installation, you are prompted to locate the Change Auditor license files. Click Open License Dialog to locate and apply a license.
4
Review your installed licensed components by right-clicking the coordinator icon in the system tray and selecting Licensing or by selecting Help | About | Licensing in the client.
To apply licenses after initial installation:

If you purchased more Change Auditor products after the initial installation, you can apply new licenses from the coordinator icon in the system tray.

1
Right-click the coordinator icon in the system tray and select Licensing.
2
From the Licenses tab, click Select License.
3
Locate and apply the new product licenses.
The new licenses are applied once the configuration is updated.

Getting started with Change Auditor 7.5

•
Upgrade and compatibility
•
Additional resources
•
 

The document was helpful.

选择评级

I easily found the information I needed.

选择评级