Configuring using a Microsoft 365 license

To audit your Azure AD (renamed as Entra ID) environment using a Microsoft 365 license, ADAudit Plus uses the Microsoft 365 Management API for all installations after ADAudit Plus build 7050.

Privileges required while using Microsoft 365 Management API

• Microsoft Graph API > Directory.Read.All
• Office 365 Management API > ActivityFeed.Read

Note A Microsoft 365 license is required for auditing Microsoft 365 services, including Exchange Online, SharePoint Online and OneDrive.

Register an application

Register an application in the Azure portal, using these steps:

1. Go to the Azure portal, and sign in using your Microsoft account.
2. Select the Azure Active Directory service from the Azure services top pane.



3. Go to Manage > App registrations > + New registration to open the Register an application window.

   

4. Enter the application name, for example, ADAudit Plus Application.
5. Ensure that Accounts in this organizational directory only (zohoadapazure only - Single tenant) is selected under Supported account types.



6. Click Register.

Grant minimum privileges required for Microsoft 365 Management API

Grant the necessary privileges using Microsoft 365 Management API, using these steps:

1. Go to the Azure portal, and sign in using your Microsoft account.
2. Select the Azure Active Directory service from the Azure services section.



3. Go to Manage > App registrations. Select your application under Owned applications.



4. Go to Manage > API permissions and select + Add a permission to open the Request API permissions window.



5. Select Office 365 Management APIs.



6. Choose Application permissions.



7. In the Request API permissions window, select Application permissions, then check the ActivityFeed.Read box under ActivityFeed. Select Add permissions.



8. Once again, go to Manage > API permissions > + Add a permission.



9. Select Microsoft Graph in the Request API permissions window.



10. Select Application permissions.



11. Check the Directory.Read.All box under Directory. Select Add permissions.



12. Select Grant admin consent for <tenant name>.



13. Click Yes.

Obtain the tenant name

1. Go to the Azure portal, and sign in using your Microsoft account.
2. Search for and select Microsoft Entra ID.

   

3. Go to Manage > Custom domain names.
4. Click Add filter.
5. Set Filter to Status and Value to Verified, and then click Apply.

   

6. From the listed domains, copy a name of a domain (preferably one that ends with .onmicrosoft.com) as this will be needed when setting up Azure AD in ADAudit Plus.

   

Obtain client ID and client secret

1. Go to the Azure portal, and sign in using your Microsoft account.
2. Select the Azure Active Directory service from the Azure services section.



3. Go to Manage > Certificates & secrets.
   • Click + New client secret.
   • Type in the description and the expiration date.
   • Click Add.








4. Copy the client secret value (e.g., 14uCILxkHtIVGR3wkCq12341Nd5VtestkkWTyIPrrE=).



5. Go to Manage > App registrations. Select your application under Owned applications.



6. Navigate to Application (client ID) and click Copy to clipboard.

Setting up Azure AD in ADAudit Plus

1. Open the ADAudit Plus web console.
2. Go to Configuration > Configured Server(s) > Cloud Directory.



3. Select + Add Tenant.
4. Select Audit via Office 365.
5. In the Cloud Directory window, enter the Tenant Name, Client ID, and Client Secret.



Note To obtain the tenant name:

• Go to the Azure portal, and sign in using your Microsoft account.
• Search for and select Microsoft Entra ID.



• Go to Manage > Custom domain names.
• Click Add filter, under Filter, select Primary from the dropdown, and under Value, select Yes from the dropdown.



• Copy the name of the primary domain that is displayed and paste it in the Tenant Name field.



6. Click Add.

Privileges required for Office 365 cmdlet configuration

ADAudit Plus uses the below-listed APIs to audit Azure AD.

• Office 365 Management API for all installations after ADAudit Plus build 7050.
• PowerShell cmdlets (unified audit log) for tenants who configured Azure AD via Office 365 before ADAudit Plus build 7050.

Check and migrate O365 cmdlet configuration to M365 API configuration

1. Open the ADAudit Plus web console.
2. Go to Configuration > Configured Server(s) > Cloud Directory.
3. Under the Actions column in the report, select the Migrate icon.
Note This is only necessary for tenants who configured Azure AD via O365 before build 7050. This feature will be available once the users upgrade to build 7050 or above.

4. In the Migrate to M365 API window that opens, enter the Client ID and Client Secret generated previously.



5. Click Migrate.

If you still want to use O365 cmdlet configuration and you are using an ADAudit Plus build lower than 7050, you can find the privileges required below:

Listed below are the system specifications required:

i. Microsoft .NET Framework 4.0

To check whether .NET Framework 4.0 is installed:

• Go to Start > Command Prompt.
• Type in the following query: reg query

"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\full" /v version.

• Ensure that the version number is 4.0.
  • If not, download NET Framework 4.0 from here and install it.

ii. PowerShell version 3

To check whether PowerShell is installed:

• Go to Start > Run.
• Type in PowerShell.
• If PowerShell is installed, check for its version number by typing in the following query in the command prompt: $PSVersionTable.
• If PowerShell is not installed or if the existing PowerShell version is below 3, you can install or upgrade to version 3 from here.

iii. Azure AD module for Windows PowerShell

To check whether the Azure AD module is installed:

• Go to Start > Run
• Type in PowerShell.
• Type in the query get-module -Name AzureAD. This will list the module if it's already installed. In case it's not, install the module by running the PowerShell cmdlet Install-Module Azure AD.