Office 365
Introduction
Office 365 O11ySource monitors Microsoft 365 audit logs including Azure Active Directory, Exchange Online, SharePoint Online, and other workload activities. It provides visibility into user and admin operations, security events, and compliance data across the Microsoft 365 ecosystem.
Getting Started
Compatibility
The Office 365 O11ySource supports Microsoft 365 commercial tenants with Unified Audit Logging enabled.Currently this o11ysource supports Office 365 logs.Supported Licenses and Audit Retention:Microsoft 365 Business Basic / Standard / Premium → 90 daysOffice 365 E1 → 90 daysOffice 365 E3 / Microsoft 365 E3 → 90 daysOffice 365 E5 / Microsoft 365 E5 → 1 yearMicrosoft 365 E5 Compliance (add-on) → 10 yearsContent Types Supported:Audit.AzureActiveDirectoryAudit.ExchangeAudit.SharePointAudit.GeneralDLP.All
Data Collection Method
vuSmartMaps collects Office 365 audit log data using VuNet's Logbeat agent via the Office 365 Management Activity API (o365audit input type).
Logbeat authenticates to the API using Azure AD OAuth 2.0 client credentials (application_id + client_secret) and subscribes to the configured content type feeds.
Prerequisites
Inputs for Configuring Data Source
- Tenant ID: The Azure Active Directory Tenant ID (GUID) associated with your Microsoft 365 organization.
- Application ID: The Application (Client) ID from your Azure App Registration that has permission to access the Office 365 Management API.
- Client Secret: The Client Secret generated for your Azure App Registration.
- Contents: Types of contents
- Content Type: Select the Office 365 audit log content types to collect. Multiple selections are allowed.
Firewall Requirement
To collect data from this O11ySource, ensure the following ports are opened:
| Source IP | Destination IP | Destination Port | Protocol | Direction |
|---|---|---|---|---|
| IP address of the server where the Agent is running | vuSmartMaps Kafka Broker IP | 9092 (Non SSL) / 9094 (SSL)* | TCP | Outbound |
*Before providing the firewall requirements, please update the port based on the customer environment.
Configuring the Target
Step 1: Azure App Registration
- Go to Azure Portal → Azure Active Directory → App registrations → New registration
- Name: o365-monitoring (or any name)
- Supported account types: This tenant only
- Note the Application (client) ID → used as application_id
- Note the Directory (tenant) ID → used as tenant_id
Step 2: Create a Client Secret
- Go to Certificates & secrets → New client secret
- Copy the Value column immediately after creation
- Note: The secret Value is shown only once. If lost, delete and recreate.
Step 3: API Permissions (Admin Consent Required)
- Go to App registrations → API permissions → Add a permission
- Select APIs my organization uses → Office 365 Management APIs
- Select Application permissions and add:
1. ActivityFeed.Read — Read audit logs for all content types
2. ActivityFeed.ReadDlp — Read DLP policy events
3. ServiceHealth.Read — Read service health events
- Click "Grant admin consent for [tenant]"
(Critical: without admin consent the API returns 401/403)
Step 4: Enable Unified Audit Logging
Run via Exchange Online PowerShell as Global Admin:
Install-Module -Name ExchangeOnlineManagement -Force
Connect-ExchangeOnline -UserPrincipalName admin@<tenant>.onmicrosoft.com
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled
# Expected output: True
Allow 30 minutes to a few hours after enabling before data starts flowing.
Configuration Steps
Enablethe Office 365 Logs O11ySource.- Select the Sources tab and press the
+button to add a new Office 365 tenant. - Enter the required details:
- Source ID: unique label for this tenant instance
- Tenant ID: Directory (tenant) ID from Azure AD
- Application ID: Application (client) ID from App Registration
- Client Secret: Secret Value (not the Secret ID) from Certificates & secrets
- Select the Content Types to collect (one or more):
- Audit.AzureActiveDirectory
- Audit.Exchange
- Audit.SharePoint
- Audit.General
- DLP.All
- Click
Next. - The following packages will be available for download:Download Logbeat Installation Binary - Downloads the full Logbeat package (x-pack enabled) with required configurations for a fresh installationDownload Logbeat Update Configuration - Downloads the agent configuration package to update an existing Logbeat installation
- Download the agent installation or update package, then click
Finishto close the data source window.
Metrics Collected
| Name | Description | Data Type |
|---|---|---|
| timestamp | Timestamp of the audit log event. | DateTime64 |
| target | Target identifier for the log event (mapped from tenant_id). | String |
| type | Log type identifier. | String |
| doc_type | Document type tag for routing and filtering. | String |
| vublock_name | VuBlock identifier for this O11ySource. | String |
| source_id | Source instance identifier (tenant_id value). | String |
| Workload | Microsoft 365 workload that generated the event (e.g., Exchange, SharePoint). | String |
| Operation | The operation performed, as recorded in the audit log. | String |
| UserId | The UPN of the user who performed the action. | String |
| ResultStatus | Result status of the operation (Succeeded, Failed, etc.). | String |
| o365audit_UserId | Office 365 User ID who performed the action. | String |
| o365audit_Workload | Workload identifier from the raw O365 audit record. | String |
| o365audit_Operation | Raw operation name from the O365 audit record. | String |
| o365audit_ResultStatus | Raw result status from the O365 audit record. | String |
| o365audit_ClientIP | Client IP address from which the operation was performed. | String |
| o365audit_GeoLocation | Geo-location derived from the client IP address. | String |
| o365audit_ObjectId | Identifier for the object affected by the operation. | String |
| o365audit_UserAgent | User agent string of the client that performed the operation. | String |
| o365audit_ClientInfoString | Additional client information string from the audit record. | String |
| o365audit_ErrorNumber | Error number if the operation resulted in an error. | String |
| o365audit_OperationCount | Count of operations recorded in this audit event. | UInt64 |
| o365audit_MailboxOwnerUPN | UPN of the mailbox owner (Exchange audit logs). | String |
| o365audit_Item_Subject | Subject of the email or calendar item (Exchange audit logs). | String |
| o365audit_SiteUrl | URL of the SharePoint site where the event occurred. | String |
| o365audit_SourceFileName | Name of the file involved in the SharePoint operation. | String |
| o365audit_SourceFileExtension | File extension of the file involved in the SharePoint operation. | String |
| o365audit_TeamName | Name of the Microsoft Teams team where the event occurred. | String |
| o365audit_ChannelName | Name of the Teams channel where the event occurred. | String |
| o365audit_Target_0_ID | Primary target identifier from the Azure AD audit record. | String |
| o365audit_ModifiedProperties_0_Name | Name of the property modified in the operation. | String |
| o365audit_ModifiedProperties_0_NewValue | New value of the modified property. | String |
| o365audit_ModifiedProperties_0_OldValue | Previous value of the modified property. | String |
| message | Raw audit log message content. | String |
