Security Compliance

Register Azure Application for integrating Office 365 Management API with SEM

This article describes how to set up Azure so that the Microsoft Office 365 Management API can be integrated with SEM.

First published date

4/27/2021 9:44 PM

Last published date

6/6/2023 6:56 PM

Overview

This article gives step-by-step procedures showing how to set up Azure so that the Microsoft Office 365 Management API can be integrated with SEM.

Product section

Security Event Manager

Cause

n/a

Resolution

SEM uses the Office 365 Management API to access ExchangeOnline and Azure Active Directory events.

To retrieve events, Office 365 auditing must be enabled. You should check that auditing has been enabled and that you can see event data at https://protection.office.com, under Audit log search. For more information, see Search the audit log in the compliance center (© Microsoft 2021, retrieved 5/19/21). If not enabled, the procedures for enabling auditing can be found at Turn audit log search on or off (© Microsoft 2021, retrieved 5/19/21).

The following permissions are required:
  • ActivityFeed.Read
  • ActivityFeed.ReadDlp (Optional - this permission enables the DLP (Data leak protection) data to be read.)
To assign the required permissions, perform the following steps.
  1. Go to the Azure Portal Website (https://ms.portal.azure.com) and log in with admin credentials.
  2. Click Azure AD Connect.

    sem-azure-365-setup-01.png

  3. Click App registrations.

    sem-azure-365-setup-02.png

  4. Click New registration.

    sem-azure-365-setup-03.png

  5. Assign a name to the registration and click register.

    sem-azure-365-setup-05.png

  6. Click Overview.
  7. Make a note of the Application ID (client ID) and Directory ID (tenant ID). These will be used when configuring the Microsoft365 Audit Log in SEM (see below ). 

    sem-azure-365-setup-06.png

  8. Click Certificates & secrets.
  9. Click New client secret.

    sem-azure-365-setup-07.png

  10.  Enter a Description, and select the longest expiry period for the client secret. 

    Note: Once the client secret expires, SEM will not be able to get data from O365 Management API. You should therefore carefully monitor this so you can create a new client secret and reconfigure the connector in SEM before the old secret expires to avoid an outage.

    sem-azure-365-setup-08.png

  11. Make a note of, or save to a file, the client secret. The Client secret will be used as the password to access Azure/O365 resources when configuring the Microsoft365 Audit Log in SEM (see below ). 

    sem-azure-365-setup-09.png

  12. Click API permissions.

    sem-azure-365-setup-10.png

  13. Click Add a permission. 

    sem-azure-365-setup-11.png

  14. Click Office 365 Management APIs.

    sem-azure-365-setup-16.png

  15. Click Application permissions.

    sem-azure-365-setup-17.png

  16. Click expand all, and enable the following:
    • Enable ActivityFeed.Read.
    • Enable ActivityFeed.ReadDlp (Optional - this permission enables the DLP (Data leak protection) data to be read.)

    sem-azure-365-setup-18.png

  17. Click Grant admin consent for...

    sem-azure-365-setup-19.png

  18. Confirm the dialog box.

    sem-azure-365-setup-20.png

Once approval has been granted, the Tenant ID, Client ID, and Client secret can thenbe used to configure Azure resources in SEM as shown below.
final.png

All screenshots © 2021 Microsoft.