Skip to main content

Office365 Audit API

Obtain Tenant ID from Azure Active Directory​

Your organization's Tenant ID from Azure Active Directory (Entra ID) will allow Fluency to use the Office365 Management APIs to poll for your data.

If you do not know your TenantID, this value can be found in the Azure Active Directory (Entra ID) portal at https://aad.portal.azure.com/.

Configure the Office365 plugin in Fluency​

Login to the Fluency Cloud portal: https://(companyname).cloud.fluencysecurity.com.

Open the dropdown menu and choose the Cloud Integrations option under the Data Ingress section.

On the following page, navigate to the Office Software as a Service section.

To edit/view/configure an existing connector, look for the Office365 Audit integration endpoint from the list on the right side of the page, and choose the gear icon.

To add a new connector, click the Office365 Audit icon from the list on the left side of the page.

In the pop-up window, provide a Customer name for this integration. Normally, this will just be the name of your organization. This value will be used solely within Fluency.

Then, enter the Tenant ID for the organization that was obtained earlier. Click "Proceed" to save this configuration.

You will be redirected to a Microsoft login page to provide Admin consent.

Please ensure that the Microsoft account used in the following section has the Administrative privileges to provide the required consent on behalf of your organization.

Review/Accept Permission grant request​

The following permissions are required in order to enable Fluency to access User Account Audit events via the Office365 Management API:

  • Read activity data for your organization
  • Read service health information for your organization
  • Read DLP policy events including detected sensitive data
  • Read user profile

You will see the following page after successful authentication:

Upon granting consent, you will be redirected back to the Fluency portal.

Please contact the Fluency Support team if you encounter any errors in the above process.

Additional Information​

Remove permissions​

Admin users can remove the permissions for the Application at anytime from Azure Active Directory's Enterprise applications page.

Microsoft documentation reference​

See: https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference

Troubleshooting​

Enable Auditing for Account/Organization​

Before you can access data through the Office 365 Management Activity API, you must enable unified audit logging for your Office 365 organization. (Normally, this is enabled by default.)

For instructions, see the following Microsoft link:

https://learn.microsoft.com/en-us/purview/audit-log-enable-disable?view=o365-worldwide

Additional Information​

For additional troubleshooting help:

Office 365 Management Activity API FAQs and troubleshooting

Page last updated: 2023 Sep 28