Collect Microsoft 365 Logs

This guide walks through configuring your Microsoft 365 tenant so the Bindplane Microsoft 365 source can collect logs and metrics. You register an application in Microsoft Entra ID (Azure AD), grant it the required API permissions, generate a client secret, and turn on audit logging in Microsoft Purview.

Prerequisites

• An instance of Microsoft 365 with the required subscriptions: Microsoft 365 Business Basic, Microsoft 365 E5 Compliance, and Microsoft 365 E3 (the equivalent upgraded versions work as well).
• Access to an Admin account for the Microsoft 365 instance to be monitored.

Register an application in Azure AD

The steps below register the receiver in Azure and grant the permissions it needs to read reports (metrics) and the activity feed (logs).

1. Log in to Azure under an Admin account for the Microsoft 365 instance to be monitored.
2. Register the receiver: Go to Azure Active Directory → App Registrations → New Registration. Give the app a descriptive name like "365 Receiver". For Supported account types, select the single-tenant option and leave the Redirect URI empty.
3. Add API permissions: Under the application, select View API Permissions → Add Permissions. The permissions differ for metrics and logs; add the ones for the telemetry you intend to collect.

• Metrics: Select Microsoft Graph → Application Permissions, find the Reports group, and select Reports.Read.All. Click Add Permissions.
• Logs: Select Office 365 Management APIs → Application Permissions, then select ActivityFeed.Read, ActivityFeed.ReadDlp, and ServiceHealth.Read. Click Add Permissions.

1. Grant admin consent: Select Grant admin consent for {organization} and confirm. This lets the application access the data returned by the Microsoft Graph and Office 365 Management APIs.
2. Generate a client secret: Open the Certificates & secrets tab. Under Client Secrets, select New Client Secret, give it a meaningful description, and select the recommended 180-day period. Copy the value in the Value column immediately, as it is only shown once.

NOTE

The receiver must be reconfigured with a newly generated client secret once the initial one expires.

1. Save the Client ID and Tenant ID: On the application's overview page, copy Application (client) ID and Directory (tenant) ID. You will enter these, along with the client secret, when you configure the Microsoft 365 source in Bindplane.

Enable audit logs in Microsoft Purview

The first time a Microsoft 365 tenant is set up for log collection, you must turn on audit logging.

1. Log in to the Microsoft Purview compliance portal with an admin account.
2. Go to Solutions → Audit.
3. If auditing is not yet on, a banner prompts you to start recording user and admin activity.
4. Select Start recording user and admin activity.

It takes up to 60 minutes for the change to take effect. Do not run the receiver with logs enabled until then, or it will fail. After auditing is enabled, it can take up to 12 hours for logs to first become available from the API.