Microsoft 365 - Cloud Log Collection Configuration
Introduction
Microsoft 365 is Microsoft’s cloud-powered productivity platform widely used by many organisations. Microsoft 365 (formerly known as Office 365) offers a range of productivity tools, such as Microsoft Teams, Word, Excel, PowerPoint, Outlook, OneDrive, and much more.
Snare Central is offering a convenient way to collect audit logs generated by a variety of Microsoft 365 apps and tools and store them in the Snare Central Archive for reporting, analysis and compliance.
This setup guide will cover the basic required setup for the SNARE - Microsoft 365 cloud log collection to work. Security related setup, charges you may incur, and other intricacies related to Microsoft 365 will not be covered in detail in this guide.
Overview
Snare Central can be configured to collect audit logs from Microsoft 365 cloud using the Office 365 Management API.
Snare Central needs to request authentication keys from Microsoft Entra ID in order to connect to the API. Once authentication is accepted, Snare Central will be able subscribe for the target audit logs and collect those logs as well.
Snare Central and Office 365 Management API communication
In order for the Snare Central to properly communicate with Office 365 Management API, these things need to be configured first on Microsoft 365 side:
Turn the Microsoft 365 log auditing on.
Register Snare Central in Microsoft Entra ID.
Turning Microsoft 365 log auditing on or off
Before you can access details and logs through the Office 365 Management API, you must enable unified audit logging for your Microsoft 365 organization. This is done by turning on the Microsoft 365 audit log.
An administrator must turn on audit logging from the Security & Compliance Center.
For instructions, see https://learn.microsoft.com/en-us/purview/audit-log-enable-disable#turn-on-auditing.
Register Snare Central in Microsoft Entra ID
To allow Snare Central to access the Office 365 Management APIs, Snare Central must be registered in Microsoft Entra ID formerly known as Azure Active Directory (AD). This allows the Snare Central to establish an identity and specify the needed permission levels for the API access.
The Office 365 Management APIs use Microsoft Entra ID to provide authentication services that you can use to setup necessary permission rights for the Snare Central to access them.
Prerequisites:
To register Snare Central in Microsoft Entra ID, client must have a subscription to Microsoft 365 and a subscription to Azure that has been associated with your Microsoft 365 subscription.
For more details, see https://docs.microsoft.com/en-us/office/developer-program/office-365-developer-program.
Step 1: App registration
Create a dedicated application for Snare Central inside Microsoft Entra ID.
Follow steps 1~6 on this link, last output screen should look like this:
Target output:
Application (client) ID - Generated by Microsoft Entra ID, Snare Central will use this value when requesting consent from tenant admins and when requesting app-only tokens from Microsoft Entra ID. Make sure to save this value, it will be used to setup Snare Central’s connection towards Office 365 Management API.
Step 2: Key or client secret generation
Generate the necessary client secret that will be used by Snare Central’s authentication towards Office 365 Management API.
Follow steps 1~4 on this link, last output screen should look like this:
Target output:
Client Secret: Make sure to copy and save the text in the “Value” column for the generated credential. Microsoft Entra ID only displays this value at the time of its generation, it will be masked after that. Also, this value will be used to setup Snare Central’s connection towards Office 365 Management API.
Note: A user is allowed to create and use multiple client credentials.
Step 3: Setting up APIs permissions
Configure and setup the required permissions for Office 365 Management API connection and interaction with Snare Central.
Follow steps 1~5 on this link, last output screen should look like this:
Target output: The following permissions were set for Office 365 Management APIs, where Type is Application and Admin consent required is set to Yes.
ActivityFeed.Read
ActivityFeed.ReadDlp
ServiceHealth.Read
Setting Up Snare Central - Microsoft 365 Cloud Log Collection
Starting from Snare Central v8.6.0, Microsoft 365 Cloud Log Collection functionality will be available as long as you have the proper license for it.
This capability requires a license with either Office 365 Logs Collection (IA_CLOUD_O365) or Cloud Logs Collection (IA_CLOUD) license features.
This guide will help you setup up your Snare Central and start collecting supported Microsoft 365 audit logs in no-time by simply using the intuitive Cloud Log Collection Configuration Web UI of Snare Central.
For more info about the supported Microsoft 365 Log types, see: Supported Microsoft 365 Log Types.
Step 1. Go to Snare Central and navigate to System > Administrative Tools > Cloud Log Collection Configuration.
Step 2. Select Microsoft 365 and Click ADD CLOUD COLLECTION button.
Step 3. Input all the necessary Microsoft 365 Cloud Collection Configuration Information and click Test Connection Button to check if the configuration is correct and can properly connect to the Office 365 Management API.
Name: Any name to easily identify this Microsoft 365 Cloud Log Collector.
Enabled: Can be toggled ON/OFF. This will determine if the Microsoft 365 Cloud Collector will be enabled and start log collection (This can also be toggled ON/OFF easily later after setup).
Content Types: Defines the target content blobs to be retrieved by the Snare Central from the Office 365 Management API. For supported content_types, please Microsoft’s documentation here.
Fetch Interval: Log collection interval (in millisecond) for each log collection request, should not be less than 120000 or greater than 86340000.
Domain: Fetch the Primary domain value on the main page of the Azure portal site.
Tenant ID: Fetch the Tenant ID value on the same Azure portal site.
Organization ID: The organization or company name or you can fetch the Name value on the same Azure portal site.
Client ID: Fetch the Application (client) ID that was generated during App registration process above.
Client Secret: Fetch the “Value” that was generated during “Key or client secret generation” process.
Note: Optional field that you may use to note any related information to this Microsoft 365 Cloud Log Collector
Step 4. Click ADD button, then you should be able to see the added Microsoft 365 Cloud Log Collector under the Microsoft 365 Cloud Collection List.
Updating/Deleting - Microsoft 365 Cloud Log Collection Configuration
If you want to update or delete an existing Microsoft 365 - Cloud Log Collector that were previously configured, you can simply use the Snare Central’s Cloud Log Collection Configuration Web UI and follow the simple steps below.
Step 1. Go to Snare Central and navigate to System > Administrative Tools > Cloud Log Collection Configuration.
Step 2. Select Microsoft 365 and Click the Microsoft 365 Log Collector that you want to update.
Collector details panel will open on the right-hand side.
Click the Edit icon on the top right of the details panel.
Step 3. In the Edit screen, you can update the configuration and optionally do a Test Connection to check if the updated configuration can successfully connect to the Office 365 Management API, then simply click the SAVE button to save the updated configuration.
Step 1. Go to Snare Central and navigate to System > Administrative Tools > Cloud Log Collection Configuration.
Step 2. Select Microsoft 365 and Click the Microsoft 365 Collector that you want to delete.
Collector details panel will open on the right-hand side.
Click the Delete icon on the top right of the details panel.
Troubleshooting Guide
This guide will be your resource for resolving common issues and challenges that you may encounter with Microsoft 365 - Cloud Log Collection.
Microsoft 365 icon is gray in System > Administrative Tools > Cloud Log Collection Configuration Web UI.
When Microsoft 365 icon in Cloud Log Providers list is gray, it is possible that Snare Central does not have IA_CLOUD or IA_CLOUD_O365 license.
You can check it via navigating to Status > Snare Health Checker or simply click the heart icon in the lower left corner of Snare Central and scroll down to Snare Central License and select Show Details to view the License Information.
If there are no IA_CLOUD or IA_CLOUD_O365 in the License Information, then you needed the correct license with IA_CLOUD or IA_CLOUD_O365. Once you have the correct license, click License Page button.
In the License Update page, click Browse button and navigate to the correct license then click Load License button.
Wait for a while then navigate to System > Administrative Tools > Cloud Log Collection Configuration and you should be able to see Microsoft 365 icon is now green and you should be able to Add Microsoft 365 Cloud Collection.
Microsoft 365 Cloud Log Collector icon is gray and the Status is Not Running (Disabled by configuration)
When your configured Microsoft 365 Cloud Log Collector icon is gray, it is possible that the log collector is disabled during configuration or toggled off.
Select the Microsoft 365 Cloud Log Collector and check if Status: Not Running (Disabled by configuration)
To enable Microsoft 365 Cloud Log Collector, simply toggle on the Enable button beside its name in Cloud Log Providers or the one in the upper right corner beside the Edit icon, then click Confirm in the pop-up dialog box.
Once toggled to ON, the configured Microsoft 365 Cloud Log Collector icon should be green and enabled. Snare Central will now start collecting Microsoft 365 audit Logs (assuming that the configuration parameters were valid and working).
Microsoft 365 Cloud Log Collector icon is red and the Status is Not Running (Could not generate access token for ….)
When the Microsoft 365 Cloud Log Collector icon is red and Status is Not Running (Could not generate access token for ….), it is possible that the Client ID or Client Secret is invalid or expired.
Go to Azure portal site and check if Tenant ID is correct or the Client ID and Client Secret is not yet expired or check if the value entered in the Snare Central cloud collection configuration is correct.
See App Registration steps above for the identification of Client ID and Client Secret.
If the value entered in the Snare Central Configuration is incorrect, you can simply edit it by clicking the Edit icon on the upper left corner.
Microsoft 365 Cloud Log Collector icon is red and the Status is Running (Subscription error on ….)
When the Microsoft 365 Cloud Log Collector icon is red and Status: Running (Subscription error on ….)Running (Subscription error on ….), it is possible that the Office 365 Management API permission were not properly set.
Go to Azure portal site, check the assigned application at Application Registration and verify if the permissions were properly set. See App Registration steps above for the verification of the API permission.
If the permissions were not correct, please add or update the application with the right sets of API permissions, then re-enable the collector by Disabling and Enabling Microsoft 365 Cloud Log Collector again after 1 minute.
If the right permissions were there it might be that the Client ID or Client Secret does not match with the configured application, check if the configured Client ID or Client Secret were correct.
Microsoft 365 Cloud Log Collector icon is red and the Status is Not Running (Cannot connect to microsoft API, please check the IP configuration …)
When the Microsoft 365 Cloud Log Collector icon is red and the Status is Status: Not Running (Cannot connect to microsoft API, please check the IP configuration of the Snare Central.), it is possible that the IP Configuration is incorrect.
Go to Snare Central and navigate to System > Administrative Tools > Configuration Wizard > IP Address Configuration then check if the IP Configuration parameters were correct (most of the time the problem lies on the Domain Name Server(s)).
After updating necessary IP Configuration parameter/s, re-enable the collector by Disabling and Enabling Microsoft 365 Cloud Log Collector again after 1 minutes.
Microsoft 365 Cloud Log Collector icon is red and the Status is Not Running (Cannot connect to proxy server, ….)
When the Microsoft 365 Cloud Log Collector icon is red and the Status is Status: Not Running (Cannot connect to proxy server, ….), it is possible that the proxy was enabled in the Snare Central with incorrect settings.
Go to Snare Central and navigate to System > Administrative Tools > Configuration Wizard > Network Services then Proxy Settings, check the ff.
Check if the value of Proxy address and Proxy port were correct.
If proxy address and port were correct, check if the proxy server is up and running.
If proxy server is OK, check the Snare Central’s firewall settings here, System > Administrative Tools > Configuration Wizard > Firewall Setup (example: if target proxy port was allowed or not), same goes with the firewall settings of the proxy server and port, check if they were properly configured.
After updating necessary Proxy Settings or configured the proper firewall settings, re-enable the collector by Disabling and Enabling Microsoft 365 Cloud Log Collector again after 1 minute.
Microsoft 365 Cloud Log Collector icon is red and the Status is Not Running (Invalid proxy credentials...)
When the Microsoft 365 Cloud Log Collector icon is red and the Status is Status: Not Running (Invalid proxy credentials, please re-configure these parameters.), it is possible that the proxy was enabled in the Snare Central with incorrect settings.
Go to Snare Central and navigate to System > Administrative Tools > Configuration Wizard > Network Services then Proxy Settings, check the ff.
Check if the value of Proxy user and Proxy password were correct.
After updating necessary Proxy Settings, re-enable the collector by Disabling and Enabling Microsoft 365 Cloud Log Collector again after 1 minute.
Microsoft 365 Cloud Log Collector icon is red and the Status is Not Running (Invalid proxy type…)
When the Microsoft 365 Cloud Log Collector icon is red and the Status is Status: Not Running (Invalid proxy type, please re-configure 'type' based on the actual proxy server type.), it is possible that the proxy was enabled in the Snare Central with incorrect settings.
Go to Snare Central and navigate to System > Administrative Tools > Configuration Wizard > Network Services then Proxy Settings, check the ff.
Check if the value of Proxy type is correct.
After updating necessary Proxy Settings, re-enable the collector by Disabling and Enabling Microsoft 365 Cloud Log Collector again after 1 minute.