> For the complete documentation index, see [llms.txt](https://docs.bindplane.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bindplane.com/how-to-guides/cloud-and-platform-integrations/collect-microsoft-365-logs.md).

# Collect Microsoft 365 Logs

This guide walks through configuring your Microsoft 365 tenant so the Bindplane [Microsoft 365 source](/integrations/sources/microsoft-365.md) can collect logs and metrics. You register an application in Microsoft Entra ID (Azure AD), grant it the required API permissions, generate a client secret, and turn on audit logging in Microsoft Purview.

### Prerequisites

* An instance of Microsoft 365 with the required subscriptions: Microsoft 365 Business Basic, Microsoft 365 E5 Compliance, and Microsoft 365 E3 (the equivalent upgraded versions work as well).
* Access to an Admin account for the Microsoft 365 instance to be monitored.

### Register an application in Azure AD

The steps below register the receiver in Azure and grant the permissions it needs to read reports (metrics) and the activity feed (logs).

1. **Log in to Azure** under an Admin account for the Microsoft 365 instance to be monitored.
2. **Register the receiver:** Go to Azure Active Directory → **App Registrations** → **New Registration**. Give the app a descriptive name like "365 Receiver". For **Supported account types**, select the single-tenant option and leave the Redirect URI empty.
3. **Add API permissions:** Under the application, select **View API Permissions** → **Add Permissions**. The permissions differ for metrics and logs; add the ones for the telemetry you intend to collect.

* **Metrics:** Select **Microsoft Graph** → **Application Permissions**, find the **Reports** group, and select **Reports.Read.All**. Click **Add Permissions**.
* **Logs:** Select **Office 365 Management APIs** → **Application Permissions**, then select **ActivityFeed.Read**, **ActivityFeed.ReadDlp**, and **ServiceHealth.Read**. Click **Add Permissions**.

4. **Grant admin consent:** Select **Grant admin consent for `{organization}`** and confirm. This lets the application access the data returned by the Microsoft Graph and Office 365 Management APIs.
5. **Generate a client secret:** Open the **Certificates & secrets** tab. Under **Client Secrets**, select **New Client Secret**, give it a meaningful description, and select the recommended 180-day period. Copy the value in the **Value** column immediately, as it is only shown once.

{% hint style="info" %}
**NOTE**

The receiver must be reconfigured with a newly generated client secret once the initial one expires.
{% endhint %}

6. **Save the Client ID and Tenant ID:** On the application's overview page, copy **Application (client) ID** and **Directory (tenant) ID**. You will enter these, along with the client secret, when you configure the Microsoft 365 source in Bindplane.

### Enable audit logs in Microsoft Purview

The first time a Microsoft 365 tenant is set up for log collection, you must turn on audit logging.

1. Log in to the [Microsoft Purview compliance portal](https://compliance.microsoft.com) with an admin account.
2. Go to **Solutions** → [**Audit**](https://compliance.microsoft.com/auditlogsearch).
3. If auditing is not yet on, a banner prompts you to start recording user and admin activity.
4. Select **Start recording user and admin activity**.

{% hint style="warning" %}
It takes up to 60 minutes for the change to take effect. Do not run the receiver with logs enabled until then, or it will fail. After auditing is enabled, it can take up to 12 hours for logs to first become available from the API.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bindplane.com/how-to-guides/cloud-and-platform-integrations/collect-microsoft-365-logs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.