Office 365

The Office 365 Management Activity API provides information about various user, admin, system, and policy actions and events from Office 365 and Azure Active Directory activity logs. Microsoft Office 365 connector uses the pull method by subscribing to the Office 365 Management Activity API content types.

Prerequisites

1. Office 365 management API credentials
   1. Tenant id
   2. Client key
   3. Secret key
   4. Tenant domain
2. How to find Tenant Id?
   1. Login to the Azure Management Portal with the credentials of the tenant, subscribed to Microsoft Office 365.
   2. In the navigation menu, select Azure Active Directory.
   3. In Manage, select Properties.
   4. Copy the Tenant Id, Use this value for the Tenant Id.
3. How to find Tenant Domain?
   1. Log in to your Office 365 Admin Center as an Administrator.
   2. Click Show All
   3. Got to Settings click Domains (or click here).
   4. Find a domain that ends with .onmicrosoft.com. This is your Office 365 tenant name.
4. Register your application in Azure AD
   1. Login to the Azure Management Portal with the credentials of the tenant that is subscribed to Microsoft Office 365.
   2. In the navigation menu, select Azure Active Directory.
   3. In the Manage section, select App Registration and click New Registration.
   4. Enter the Display Name for the application.
   5. In the Supported account types section, select the type of account to use the application or to access the API.
   6. Click Register.
   7. Copy and store the Application (client) ID value. Use this value for the Client Key.
5. Generate a Client secret for the application
   1. Navigate to the Application you registered in Step 4
   2. From the Manage pane, select Certificates & secrets > Add New client secret.
   3. Enter a Description and select Expiry Date for the Client Secret and click Add.
   4. Copy and store your client secret key value because it can't be retrieved later.
6. Specify the permissions to access Microsoft Office 365 Management APIs.
   1. Navigate to the Application you registered in Step 4.
   2. Click API Permissions > Add a permission > choose Office 365 Management APIs > Delegated permissions, and then select the following options and click Add permissions.
      1. Activity Feed
         1.  ActivityFeed.Read
         2. ActivityFeed.ReadDlp
      2. ServiceHealth
         1. ServiceHealth.Read
   3. Click Application permissions, and then select the following options and click Add permissions.
      1. * Activity Feed
         1.  ActivityFeed.Read
         2. ActivityFeed.ReadDlp
      2. ServiceHealth
         1. ServiceHealth.Read
   4. In the API permissions window, click *Grant admin consent for dnifhq
   5. Click Yes to confirm.
7. Use the compliance center to turn on audit log search:
   1. Go to the compliance center and sign in (https://protection.office.com/homepage).
   2. In the compliance center, go to Search > Audit log search.
   3. Click Turn on auditing.
8. Create a subscription in Azure Portal
   1. Sign in to the Azure portal.
   2. Search for Subscriptions.
      
   3. Select Add.
      
   4. If you have access to multiple billing accounts, select the billing account for which you want to create the subscription.
   5. Fill the form and click Create. The tables below list the fields on the form for each type of billing account.
9. Check your subscriptions
   1. Visit this Microsoft Office website, click on the Sign-in button, and sign-in using the email address that you used to purchase your Office 365 subscription.
      
      
   2. Once you sign in to your Office account, you will see the following page
      
      
   3. The page displays the details of your Microsoft Office 365 subscription.

Configuration

The following are the configurations to forward Office 365 Connector logs to DNIF.‌

• Click Save after entering all the required details and click Test Connection, to test the configuration.
• A Connection successful message will be displayed on screen along with the time stamp.
• If the connection is not successful an error message will be displayed. Refer Troubleshooting Connector Validations for more details on the error message.