Compliance ready mailbox - 3: Create profiles to audit Exchange Online mailboxes

In the previous two posts I explained how to retrieve the list of auditing disabled mailboxes and how to enable them in a few clicks with O365 Manager Plus. This week, I'll explain how to create an audit profile in O365 Manager Plus.

Why O365 Manager Plus?

The following points will explain the key reasons why O365 Manager Plus' auditing feature is far advanced than Office 365's auditing feature:

• In the Office 365 portal, you have to use the inbuilt search tool to filter the required data from the audit log each and every time. This takes a lot of time, as the entire audit log has to be scrutinized for the required data.While O365 Manager Plus provides audit data immediately once a profile is created.
• In the Office 365 portal, there are retention period limitations to store historic audit data. While, O365 Manager Plus can indefinitely store the audit records.
• In O365 Manager Plus, you can retrieve audit data for a selected set of users, or for users based on group membership which is not possible in Office 365 portal.
• The audit data can also be filtered based on attribute value and business hours in O365 Manager Plus, whereas there is no such option in the native portal.
• While Office 365 doesn't support custom views, with O365 Manager Plus you can create your own custom views to see filtered data, summarized data or filtered summarized data. [Learn more]

Create audit profiles

O365 Manager Plus lets you create your own audit profiles to view the required audit data easily. Follow the below-mentioned steps to create an audit profile:

Steps to create an audit profile

• Go to Admin tab.
• Choose Audit Configuration → Audit Profiles in the left pane.
• Click Add Profile.
• In the profile configuration page, give a Profile Name and Description of your choice.
• Select Exchange Online in the Office 365 Service drop-down.
• In the Category drop-down choose a category of your choice. [Only one category can be chosen].
• Select the actions for which you want to view audit logs in the Actions drop-down. [Multiple actions can be selected.]
• Select Target Callers (one who performs the action). You can either select All or click Custom to select users or mailboxes of your choice.
• Select the Target Objects (object on which the action must be performed). You can either select All or click Custom to select users/mailboxes of your choice.

NOTE: Both Target Callers and Target Objects can either be users/mailboxes, groups or both.

• When you select custom users or groups for both Target Callers and Target Objects, you can select the desired Target Criteria, which is explained below.
• Click Add.

Now you will be taken to the Configure Profile page, where you can see the profile you created listed in the table along with the previously created profiles. Click View Report in the Reports column to view the consolidated report.

Target Criteria:

Callers AND Objects: The selected action will be logged only when both the caller and object of the action match any of the target callers and objects respectively.

Callers OR Objects: The selected action will be logged when either the caller or object of the action matches any of the target callers or objects respectively.