Office 365 Tenant

Types of data that can be collected by Netwrix Auditor from the Office 365 organization depend on the authentication option you choose, as explained in the table below.

IMPORTANT! This item-level option may influence data collection. In particular, if you decide to switch from basic to modern authentication, consider that state-in-time data for Exchange Online will be no longer collected— even if the related global setting Collect data for state-in-time reports is still enabled for the monitoring plan.

Option Azure AD audit Exchange Online audit SharePoint Online audit

Modern authentication

Activity data

Activity data

 

Activity data

State-in-time data

Basic authentication

Activity data

Activity data

State-in-time data

Activity data

State-in-time data

To configure Office 365 tenant as a monitored item:

1. On the General page of the item properties, specify Tenant name:

  • If you are going to use Basic authentication, you can proceed to the next step – Tenant name will be filled in automatically after it.
  • If you are going to use Modern authentication, paste the name you obtained at Step 4: Obtain tenant name when preparing your Azure AD app.

2. Select authentication method that will be used when accessing Office 365 services:

3. Click the Add button.

TIP: You can use a single account to collect audit data for different Office 365 services (Azure AD, Exchange Online, SharePoint Online); however, Netwrix recommends that you specify individual credentials for each of them.

NOTE: If you plan to collect and report on the audit data for Exchange Online non-owner mailbox access, consider that the value shown in the “Who” field in reports and search results will be displayed in UPN format (unlike the earlier Netwrix Auditor versions). This refers to the following scenarios:

  1. All new installations
  2. Upgrade from the previous versions if:
  • Modern authentication is selected in the item settings after the upgrade

    -OR-

  • Modern authentication has ever been selected in the item settings and reverted back to Basic later