Microsoft Office 365 Integration

The Microsoft Office 365 integration for Elastic collects activity data using the Office 365 Management Activity API. This data enables monitoring, searching, and analyzing user and admin actions across Microsoft Office 365, including activity from services like SharePoint and Exchange.

The integration works by collecting user, admin, system, and policy actions, as well as events from Office 365 and Azure AD activity logs exposed by the Office 365 Management Activity API.

• API Version: The Microsoft Office 365 integration is compatible with version 1.0 of Microsoft Office 365 Management API.
• Supported Workloads: This integration supports the following Microsoft Office 365 workloads:
  • Audit.AzureActiveDirectory
  • Audit.Exchange
  • Audit.SharePoint
  • Audit.General
  • DLP.All

For detailed information on the supported record types within these workloads, please refer to the AuditLogRecordType documentation.

This integration collects log messages of the following types:

• Audit: Uses the Office 365 Management Activity API to retrieve audit messages from Office 365 and Azure AD activity logs. These are the same logs that are available under Audit Log Search in the Microsoft Purview portal.

Integrating Microsoft Office 365 with Elastic SIEM enables collection of audit logs for monitoring and analysis, which can then be visualized in Kibana.

To use this integration you need to enable Audit Log and register an application in Microsoft Entra ID (formerly known as Azure Active Directory).

Once the Microsoft Entra ID application is registered, you can set up its credentials and permissions, and gather the information needed by the Microsoft Office 365 Elastic integration, as follows:

1. Note the Application (client) ID and Directory (tenant) ID in the registered application's Overview page.
2. Create a new secret to configure the authentication of your application, as follows:
   • Navigate to Manage -> Certificates & Secrets section.
   • Click New client secret, provide a description and create the new secret.
   • Note the Value which is required for setup of the integration.
3. Add permissions to your registered application. Please refer to the Office 365 Management API documentation for more details.
   • Navigate to Manage -> API permissions page. Under Configured permissions click Add a permission.
   • Select Office 365 Management APIs tile from the listed tiles.
   • Click Application permissions.
   • Under ActivityFeed, select ActivityFeed.Read permission. This is minimum required permissions to read audit logs of your organization as provided in the documentation. Optionally, select ActivityFeed.ReadDlp to read DLP policy events.
   • Click Add permissions.
   • If User.Read permission under Microsoft.Graph tile is not added by default, add this permission.
   • After the permissions are added, the admin has to grant consent for these permissions.

The instructions above assume that you wish to collect data from your own tenant. If that is not the case, additional steps are required to obtain tenant admin consent for the required permissions. The API documentation describes a method of gathering consent via redirect URLs, and other consent flows may be possible.

This integration supports both Elastic Managed and Agent-based installations.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.

1. In the top search bar in Kibana, search for Integrations.
2. In the search bar, type Microsoft Office 365.
3. Select the Microsoft Office 365 integration from the search results.
4. Select Add Microsoft Office 365 to add the integration.
5. Enable and configure only the collection methods which you will use.
   • To Collect audit logs, you'll need to configure Application (client) ID, Client Secret and Directory (tenant) ID.
   • Do not use DEPRECATED - Collect audit logs as it's deprecated.
6. Select Save and continue to save the integration.

1. In the top search bar in Kibana, search for Dashboards.
2. In the search bar, type Microsoft Office 365.
3. Select a dashboard for the dataset you are collecting, and verify the dashboard information is populated.

1. In the top search bar in Kibana, search for Transforms.
2. Select the Data / Transforms from the search results.
3. In the search bar, type o365.
4. All transforms from the search results should indicate Healthy under the Health column.

Most issues fall into one of the scenarios below. For expected data delays (including the up-to-12-hour wait after first setup) and out-of-order delivery, see Data latency. To confirm the integration is working, see Validation.

When debugging a permissions issue or unexpected API responses, it can be useful to enable request tracing and inspect the request trace logs to see the interaction with the server. Token values can be decoded using https://jwt.ms/, and should include a roles section with the configured permissions.

For the full list of API error codes and their meanings, see the official Office 365 Management Activity API — Errors.

Security warning: request trace files are not redacted. They contain the Authorization header and, during OAuth2 token exchange, the client secret in clear text. Only enable request tracing in a controlled debugging session, restrict access to the trace files, disable it as soon as you are finished, and rotate the client secret if a trace file that may contain it was exposed. On Elastic Managed deployments this setting is not user-configurable.

The integration reports a degraded status in Fleet and logs OAuth2 token or subscription errors (for example, POST /activity/feed/subscriptions/start?contentType=...). Confirm that the client secret has not expired, that the Directory (tenant) ID and Application (client) ID are correct, and that admin consent is still granted. Generate a new client secret and update the integration if needed. The degraded status clears on the next successful poll.

A single content type returns 401 while the others keep working when a required API permission is missing. Ensure the Azure application has ActivityFeed.Read (and ActivityFeed.ReadDlp if the DLP.All content type is enabled), grant admin consent, and wait for the next poll. The integration logs the error and skips the affected content type until the permission is granted.

If the integration is healthy but no data appears: confirm that at least one content type is enabled, that you are past the initial latency window (see Data latency), and that there is audit activity in the tenant for the enabled workloads and time window. Check the logs for successful subscription start and content listing. Subscription start runs on every poll and is idempotent, so a 400 (already subscribed) response is expected and is treated as success.

On restart, the integration resumes from its saved position and backfills the missed window. Overlapping events are de-duplicated during ingest, so a resume does not create duplicates. The API retains data for a maximum of 7 days: outages shorter than that backfill automatically, but any window older than 7 days is purged by Microsoft and cannot be recovered.

If one integration policy reports a degraded status and stops collecting while others on the same agent stay healthy, check the logs for a persistent transport failure fetching error naming a URL whose host is not the configured Base URL of Office Management API — for example http://localhost/.... The API has occasionally returned a content URL built on a miscomputed base URL, which can never be fetched, and because it is saved in the integration's cursor, restarting the agent, re-enabling the integration and editing the policy all leave it in place. Version 3.11.1 rebuilds such URLs before use and repairs an affected cursor on the next poll, so upgrading is enough.

Repeated 429 responses indicate that the API's per-tenant rate limit has been reached. This is handled automatically by the built-in retry with exponential backoff. Persistent rate limiting across many tenants that share one Azure application may mean the application is over-subscribed; consider using separate application registrations.

If the o365 transforms do not show Healthy (see Validation), open the transform to check its messages for the underlying error (for example, permissions or mapping conflicts). Resolve the error, then stop and restart the transform and confirm that it returns to Healthy.

We request that users upgrading from integration version < 1.18.0 to >= 1.18.0 follow these steps:

1. Upgrade the Elastic Stack version to >= 8.7.1.
2. Upgrade the integration navigating via Integrations -> Microsoft Office 365 -> Settings -> Upgrade
3. Upgrade the integration policy navigating via Integrations -> Microsoft Office 365 -> integration policies -> Version (Upgrade). If Upgrade option doesn't appear under the Version, that means the policy is already upgraded in the previous step. Please go to the next step.
4. Modify the integration policy:
   • Disable existing configuration (marked as Deprecated) and enable Collect Office 365 audit logs via CEL configuration.
   • Add the required parameters such as Directory (tenant) ID, Application (client) ID, Client Secret based on the previous configuration.
   • Verify/Update Initial Interval configuration parameter to start fetching events from. This defaults to 7 days. Even if there is overlap in times, the events are not duplicated.
   • Update the other configuration parameters as required and hit Save Integration.

Please refer Upgrade an integration in case of any issues while performing integration upgrade.

This integration works by creating a subscription for each enabled content type, checking each subscription for available data, and downloading any data that is available.

As discussed in Microsoft's Working with the Office 365 Management Activity API documentation, when a subscription is first created it can take up to 12 hours for the first data to become available. Users of this integration should expect to see that initial delay.

Data may become available out of order, so the earliest data will not necessarily be downloaded first. Data will be downloaded in the order in which it becomes available.

If a new integration policy is created to fetch data from existing subscriptions, earlier data may be available and the integration will try to fetch it. This can help to fill short gaps in data. The Initial Interval setting controls how far back it will look. By default it will check for data that became available in the last week, which is the maximum time range allowed by the API.

{
    "@timestamp": "2020-02-07T16:43:53.000Z",
    "agent": {
        "ephemeral_id": "f173faa4-2d61-4c41-8670-06930fd22753",
        "id": "e9670ccb-33fc-41b0-90c1-b67dcf953c6a",
        "name": "elastic-agent-35357",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "client": {
        "address": "213.97.47.133",
        "ip": "213.97.47.133"
    },
    "data_stream": {
        "dataset": "o365.audit",
        "namespace": "12427",
        "type": "logs"
    },
    "device": {
        "id": "62eedfc0-b73c-206c-a59d-16457c7ebcd8"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "e9670ccb-33fc-41b0-90c1-b67dcf953c6a",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "action": "PageViewed",
        "agent_id_status": "verified",
        "category": [
            "web"
        ],
        "code": "SharePoint",
        "dataset": "o365.audit",
        "id": "99d005e6-a4c6-46fd-117c-08d7abeceab5",
        "ingested": "2025-12-15T13:36:59Z",
        "kind": "event",
        "original": "{\"ClientIP\":\"213.97.47.133\",\"CorrelationId\":\"622b339f-4000-a000-f25f-92b3478c7a25\",\"CreationTime\":\"2020-02-07T16:43:53\",\"CustomUniqueId\":true,\"EventSource\":\"SharePoint\",\"ExtendedProperties\":[{\"Name\":\"additionalDetails\",\"Value\":\"{\\\"DeviceId\\\":\\\"62eedfc0-b73c-206c-a59d-16457c7ebcd8\\\",\\\"DeviceOSType\\\":\\\"Linux\\\",\\\"DeviceTrustType\\\":\\\"\\\"}\"}],\"Id\":\"99d005e6-a4c6-46fd-117c-08d7abeceab5\",\"ItemType\":\"Page\",\"ListItemUniqueId\":\"59a8433d-9bb8-cfef-6edc-4c0fc8b86875\",\"ObjectId\":\"https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx\",\"Operation\":\"PageViewed\",\"OrganizationId\":\"b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd\",\"RecordType\":4,\"Site\":\"d5180cfc-3479-44d6-b410-8c985ac894e3\",\"UserAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0\",\"UserId\":\"asr@testsiem.onmicrosoft.com\",\"UserKey\":\"i:0h.f|membership|1003200096971f55@live.com\",\"UserType\":0,\"Version\":1,\"WebId\":\"8c5c94bb-8396-470c-87d7-8999f440cd30\",\"Workload\":\"OneDrive\"}",
        "outcome": "success",
        "provider": "OneDrive",
        "type": [
            "info"
        ]
    },
    "host": {
        "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd",
        "name": "testsiem.onmicrosoft.com"
    },
    "input": {
        "type": "cel"
    },
    "network": {
        "type": "ipv4"
    },
    "o365": {
        "audit": {
            "CorrelationId": "622b339f-4000-a000-f25f-92b3478c7a25",
            "CreationTime": "2020-02-07T16:43:53",
            "CustomUniqueId": true,
            "EventSource": "SharePoint",
            "ExtendedProperties": {
                "additionalDetails": {
                    "DeviceId": "62eedfc0-b73c-206c-a59d-16457c7ebcd8",
                    "DeviceOSType": "Linux"
                }
            },
            "ItemType": "Page",
            "ListItemUniqueId": "59a8433d-9bb8-cfef-6edc-4c0fc8b86875",
            "ObjectId": "https://testsiem-my.sharepoint.com/personal/asr_testsiem_onmicrosoft_com/_layouts/15/onedrive.aspx",
            "RecordType": "4",
            "Site": "d5180cfc-3479-44d6-b410-8c985ac894e3",
            "UserId": "asr@testsiem.onmicrosoft.com",
            "UserKey": "i:0h.f|membership|1003200096971f55@live.com",
            "UserType": "0",
            "Version": "1",
            "WebId": "8c5c94bb-8396-470c-87d7-8999f440cd30"
        }
    },
    "organization": {
        "id": "b86ab9d4-fcf1-4b11-8a06-7a8f91b47fbd"
    },
    "related": {
        "hosts": [
            "testsiem.onmicrosoft.com"
        ],
        "ip": [
            "213.97.47.133"
        ],
        "user": [
            "asr",
            "asr@testsiem.onmicrosoft.com"
        ]
    },
    "source": {
        "ip": "213.97.47.133"
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "o365-cel"
    ],
    "user": {
        "domain": "testsiem.onmicrosoft.com",
        "email": "asr@testsiem.onmicrosoft.com",
        "id": "asr@testsiem.onmicrosoft.com",
        "name": "asr"
    },
    "user_agent": {
        "device": {
            "name": "Mac"
        },
        "name": "Firefox",
        "original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:72.0) Gecko/20100101 Firefox/72.0",
        "os": {
            "full": "Mac OS X 10.14",
            "name": "Mac OS X",
            "version": "10.14"
        },
        "version": "72.0"
    }
}

These inputs are used in this integration:

• cel
• o365audit (DEPRECATED)

This integration dataset uses the following APIs:

• Audit: Office 365 Management Activity API

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.