Microsoft 365
The Microsoft 365 source collects service and usage metrics through the Microsoft Graph reporting API and audit logs through the Office 365 Management API. A registered Azure AD application authenticates with a tenant ID, client ID, and client secret, and Bindplane scrapes the configured telemetry on an interval.
Supported Telemetry Types
macOS
✓
✓
Linux
✓
✓
Windows
✓
✓
Prerequisites
A Microsoft 365 instance with the required subscriptions (for example Microsoft 365 Business Basic, Microsoft 365 E5 Compliance, and Microsoft 365 E3, or their upgraded equivalents).
An Admin account for the Microsoft 365 instance to be monitored.
An Azure AD application registration with a client secret and admin-consented API permissions (see Setup).
For logs, auditing must be enabled on the tenant before the receiver runs. Enabling it takes up to 60 minutes, and logs may take up to 12 hours to become available afterward (see Setup).
Configuration
General
Choose Telemetry Type
Telemetry Selector
["Logs", "Metrics"]
Which telemetry to collect. Valid values are Logs and Metrics.
Tenant ID
String
Identifies the instance of Microsoft 365 to be monitored. Required.
Client ID
String
Identifier this receiver uses when monitoring. Required.
Client secret
String
Private key this receiver uses when monitoring. Must belong to the given client ID. Required and sensitive.
Logs
These parameters apply when telemetry_types includes Logs.
Poll Interval
Integer
5
How often, in minutes, to collect logs.
General Logs
Boolean
true
Collect general (Microsoft Graph) logs.
Exchange Logs
Boolean
true
Collect Exchange logs.
SharePoint Logs
Boolean
true
Collect SharePoint logs.
Azure Active Directory Logs
Boolean
true
Collect Azure Active Directory logs.
Data Loss Prevention Logs
Boolean
true
Collect Data Loss Prevention logs.
Metrics
These parameters apply when telemetry_types includes Metrics.
disable_metrics
Metrics
[]
Individual metrics to disable. Covers OneDrive, Outlook, SharePoint, and Teams metric sets.
Advanced
Collection Interval
Integer
1
How often, in hours, to scrape for metrics.
Metrics
The following metrics are emitted when Metrics collection is enabled. Individual metrics can be turned off with disable_metrics.
m365.onedrive.files.active.count
{files}
The number of active files across the OneDrive in the last seven days.
m365.onedrive.files.count
{files}
The number of total files across the OneDrive for the last seven days.
m365.onedrive.user_activity.count
{users}
The number of users who have interacted with a OneDrive file, by action in the last seven days.
activity: view_edit, synced, internal_share, external_share
m365.outlook.app.user.count
{users}
The number of unique users per app over the period of time in the organization Outlook in the last seven days.
app: pop3, imap4, smtp, windows, mac, web, mobile, other_mobile
m365.outlook.email_activity.count
{emails}
The number of email actions by members over the period of time in the organization Outlook.
activity: read, sent, received
m365.outlook.mailboxes.active.count
{mailboxes}
The number of mailboxes that have been active each day in the organization for the last seven days.
m365.outlook.quota_status.count
{mailboxes}
The number of mailboxes in the various quota statuses over the period of time in the org in the last seven days.
state: under_limit, warning, send_prohibited, send_receive_prohibited, indeterminate
m365.outlook.storage.used
By
The amount of storage used in Outlook by the organization in the last seven days.
m365.sharepoint.files.active.count
{files}
The number of active files across all sites in the last seven days.
m365.sharepoint.files.count
{files}
The number of total files across all sites in the last seven days.
m365.sharepoint.pages.unique.count
{views}
The number of unique views of pages across all sites in the last seven days.
m365.sharepoint.pages.viewed.count
{pages}
The number of unique pages viewed across all sites in the last seven days.
m365.sharepoint.site.storage.used
By
The amount of storage used by all sites across SharePoint in the last seven days.
m365.sharepoint.sites.active.count
{sites}
The number of active sites across SharePoint in the last seven days.
m365.teams.calls.count
{calls}
The number of MS Teams calls from users in the organization in the last seven days.
m365.teams.device_usage.users
{users}
The number of unique users by device/platform that used Teams in the last seven days.
device: Android, iOS, Mac, Windows, Chrome OS, Linux, Web
m365.teams.meetings.count
{meetings}
The number of MS Teams meetings for users in the organization in the last seven days.
m365.teams.messages.private.count
{messages}
The number of MS Teams private-messages sent by users in the organization in the last seven days.
m365.teams.messages.team.count
{messages}
The number of MS Teams team-messages sent by users in the organization in the last seven days.
Setup
Before configuring this source you must register an Azure AD application with the required API permissions and, for log collection, enable audit logging in Microsoft Purview. Follow the step-by-step walkthrough in Collect Microsoft 365 Logs.
That guide produces the three values you enter below: the Application (client) ID (client_id), Directory (tenant) ID (tenant_id), and client secret (client_secret).
Example Configuration
Standalone Source
Configuration Tips
Telemetry availability delays
After enabling logs on the tenant, allow up to 60 minutes for auditing to activate and up to 12 hours for logs to become available through the API. Once flowing, generated logs typically appear within 0 to 3 hours.
Metrics are reported by the API once per day, and each report contains data generated two days prior. So metrics generated on June 25 appear with a June 27 report date. Because the receiver scrapes hourly, data points within the same 24-hour reporting window are duplicates.
Selecting telemetry and categories
Use
telemetry_typesto collect logs, metrics, or both. The log category toggles (enable_general_logs,enable_exchange_logs,enable_sharepoint_logs,enable_azuread_logs,enable_dlp_logs) anddisable_metricsonly take effect for the telemetry types you enable.Make sure the API permissions you granted match the telemetry you collect. Metrics require Reports.Read.All; logs require the Office 365 Management API permissions.
Troubleshooting
Symptom: The receiver fails or returns errors when logs are enabled, shortly after setup. Solution: Confirm auditing is enabled in the Microsoft Purview compliance portal and that the 60-minute activation window has passed. Do not run the receiver with logs enabled before auditing is active. Logs can take up to 12 hours after that to appear through the API.
Symptom: Authentication fails or no data is collected. Solution: Verify the tenant_id, client_id, and client_secret are correct and that admin consent was granted for the required permissions. Client secrets expire (180 days recommended), so regenerate the secret in Azure and update the source when it lapses.
Symptom: Metrics appear duplicated or carry an unexpected date. Solution: This is expected. The API reports metrics once per day for activity two days prior, while the receiver scrapes hourly, so points within the same 24-hour report repeat. Lengthen collection_interval to reduce duplicate scrapes.
Related Resources
Last updated
Was this helpful?