MICROSOFT OFFICE 365
Instructions for forwarding Microsoft Office 365 logs to your Log Management device
PREREQUISITES
Microsoft Office 365- Office 365 Portal
- Administrator Credentials to access the Office 365 portal
- The IP Address for the Clone Systems Log Management device
1. Enable Office 365 Auditing: The following procedures detail the steps for enabling Office 365 auditing.
1. Navigate a browser to the Office 365 Portal. a browser to the Duo Admin panel.
2. On the Sign in screen of your Office 365 Portal login with your administrator account.
Login name: Your Admin email
Click Next.
Password: Your Admin password
Click Sign in
If prompted to Stay Signed in click No.
3. Note: If you are not on the Admin Center page you will need to click the App Launcher located in the top left corner and select the Admin app.
On the left-side menu of the Admin center page, select Security & Compliance located under the Admin centers menu.
Locate the left-side menu on the Admin center page.
Click Admin centers
Under Admin centers click Security & Compliance.
4. On the Audit log search page click the link to start recording user and admin activities.
Note: If you do not see a link that says Start recording user and admin activities then Auditing may already be enabled. You can click the Search button at the bottom of the screen and see if results are returned. If you see results you can skip the remaining steps in this section.
On the Audit log search page navigate to the link below the heading.
Click the Start recording user and admin activities link.
5. On the Start recording user and admin activities dialog box turn on recording for user and admin activities.
On the Start recording user and admin activities dialog box.
Click Turn on
6. A Security & Compliance dialog box may appear requiring you to update your organization.
If the Security & Compliance dialog box appears requiring you to update your organization.
Click Yes
7. The Auditing will begin within the next couple of hours. You can click the Search button at the bottom of the screen to see if results are returned.
Note: Be sure that you are seeing results before you proceed to the next section on registering the Clone Systems Appliance with Azure Active Directory.
On the Audit log search page.
Click Search
Confirm that Results are returned and displayed on the page.
The following procedures detail the steps for registering the Clone Systems Clone Guard® Log Management device.
1. Note: If you are not on the Admin Center page you will need to click the App Launcher located in the top left corner and select the Admin app.
On the left-side menu of the Admin center page, select Azure Active Directory located under the Admin centers menu
Locate the left-side menu on the Admin center page.
Click Admin centers
Under Admin centers click Azure Active Directory.
2. On the left-side menu of the Azure Active Directory admin center page, select Azure Active Directory. A menu will appear to the right of the left-side menu and you should select App registrations.
Locate the left-side menu on the Azure Active Directory admin center page.
Click Azure Active Directory
A menu will appear to the right of the left-side menu.
Click App registrations
3. On the App Registrations page click the View all applications button to display the Applications. If you do not have a CGLOGM application configured, click the New application registration button in the top menu.
The App Registrations page will appear on the right.
Click View all applications
Confirm that you do not have a CGLOGM application in the list.
Click New application registration
4. On the Create window enter the information for the Clone Systems Clone Guard® Log Management appliance and create the App registration.
Note: Record the Application ID assigned to CGLOGM.
For the Name field enter CGLOGM
For Application type drop down keep the Web app / API selection.
For the Sign-on URL field enter https://www.clone-systems.com
Click the Create button
A message box will display in the top right corner indicating: Successfully created application CGLOGM.
Click the View all applications button and you should see CGLOGM in the list of App registrations.
Note: Copy the string in the Application ID column to notepad and label it Application ID as you will need this value to configure the Office Connector in the Clone Systems Clone Guard® Log Management appliance.
5. Click CGLOGM in the Display Name column to bring up the registered app settings then click the Settings cog and when the Settings section is displayed select Required permissions under the API Access heading.
In the Display Name column click CGLOGM
Click the Settings cog in the menu below the CGLOGM Registered app heading.
The Settings section will appear, then locate the API Access section.
Click Required permissions
6. On the Required permissions section click Add to bring up the Add API access section. Click Select and API to display the Select an API section and then click Office 365 Management APIs.
The Required permissions section will appear.
Click Add
The Add API Access section will appear.
Click Select an API
The Select an API section will appear
Click Office 365 Management APIs
Click the Select button
7. On the Enable Access section locate the Application Permissions and then select the checkboxes noted in the detail sections of this step.
On the same section locate the Delegated Permissions and then select the checkboxes noted in the detail sections of this step.
On the Add API access section click the Done button.
The Enable Access section will appear.
Under Application Permissions select the following checkboxes.
- Read DLP policy events including detected sensitive data
- Read activity data for your organization
- Read service health information for your organization
Under Delegated Permissions select the following checkboxes.
- Read DLP policy events including detected sensitive data
- Read activity data for your organization
- Read service health information for your organization
Click the Select button
The Add API access section will appear
Click the Done button
A message box will display in the top right corner indicating: Successfully added application Office 365 Management APIs’s permissions.
8. On the Required permissions section click Windows Azure Active Directory.
On the Enable Access section locate the Application Permissions and then select the checkbox noted in the detail sections of this step.
On the Required permission section.
Click Windows Azure Active Directory
The Enable Access section will appear.
Under Application Permissions select the following checkbox.
- Read directory data
Click the Save button
A message box will display in the top right corner indicating: Updating application Windows Azure Active Directory’ permissions.
9. On the Required permissions section click the Grant Permissions button. Then click Yes to Grant the permissions.
On the Required permission section.
Click Grant Permissions
Click Yes
A message box will display in the top right corner indicating: Successfully granted permissions for application CGLOGM.
10. On the Settings section select Keys under the API Access heading.
To the Left of the Required permission section is the Settings section.
Locate the API Access heading
Click Keys
11. On the Keys section enter a name for the Key and an Expiration duration.
Note: Record the Key Value assigned to CGLOGM as you will not be able to access it after you leave this section.
For the Key Description field enter CGLOGM
For Duration drop down select Never expires
Click Save
A message box will display in the top right corner indicating: Successfully updated application CGLOGM keys
Note: Copy the string in the Key Value column to notepad and label it Key Value as you will need this value to configure the Office Connector in the Clone Systems Clone Guard® Log Management appliance.
12. Using another tab in your browser, grant admin consent to the CGLOGM app so that it can access your logs.
Replace the following text below <REPLACE-THE-BRACKETS-<->-AND-THIS-TEXT-WITH-APPLICATION-ID> with the Application ID recorded in step 4.
Copy the URL and then paste into a new tab in your browser.
You may be prompted to Pick a login account and if so, select your Office 365 Administrator account.
Click Accept
You will then be redirected to the Clone Systems home page.
13. Navigate back to the Browser tab that you used to configure the CGLOGM app.
On the left-side menu of the Azure Active Directory admin center page, select Azure Active Directory. A menu will appear to the right of the left-side menu and you should select Custom domain names. Identify the Primary domain name as it will have a check mark in the Primary column.
Note: Record the primary Domain Name located in the Name column.
Locate the left-side menu on the Azure Active Directory admin center page.
Click Azure Active Directory
A menu will appear to the right of the left-side menu.
Click Custom domain names
Note: Copy the string in the Name column for the Domain Name that has a check mark in the Primary column to notepad and label it Domain Name as you will need this value to configure the Office Connector in the Clone Systems Clone Guard® Log Management appliance.
14. On the left-side menu of the Azure Active Directory admin center page, select Azure Active Directory. A menu will appear to the right of the left-side menu and you should select Properties. Identify the Directory ID field and copy the value.
Note: Record the value in the Directory ID field.
Locate the left-side menu on the Azure Active Directory admin center page.
Click Azure Active Directory
A menu will appear to the right of the left-side menu.
Click Properties
Note: Copy the string in the Directory ID column to notepad and label it Directory ID as you will need this value to configure the Office Connector in the Clone Systems Clone Guard® Log Management appliance.
15. Please provide the following values to Clone Systems to complete the configuration for forwarding Microsoft Office 365 logs to your Log Management device:
- The Application ID assigned to CGLOGM
- The Key Value assigned to CGLOGM
- The primary Domain Name
- The Directory ID
