Skip to main content

Microsoft Office 365 Audit connector setup

Polls unified audit logs from the "Office 365 Management Activity API" for Exchange, SharePoint, Azure AD, General, and DLP workloads.

What you need first​

RequirementDetails
Microsoft 365 tenantGlobal administrator or equivalent to register apps and grant consent
Unified audit logAudit logging enabled for the workloads you plan to collect
Tenant IDAzure AD directory (tenant) GUID
RegionCommercial (manage.office.com) or GCC (manage.office365.us)

"One subscription per workload per tenant. Microsoft allows only one active Management API subscription per content type per tenant."

1. Register an Azure application​

  1. Sign in to the Microsoft Entra admin center.
  2. Go to Applications → App registrations → New registration.
  3. Name the app (e.g. Perpetual Office 365 Audit).
  4. Choose Accounts in this organizational directory only.
  5. Click Register (no redirect URI required).
  6. Copy the Application (client) ID and Directory (tenant) ID from Overview.

API permissions​

  1. Open API permissions → Add a permission.
  2. Choose APIs my organization uses, search for "Office 365 Management APIs" (not Microsoft Graph).
  3. Add Application permissions:
    • ActivityFeed.Read — required for all workloads
    • ActivityFeed.ReadDlp — required only if enabling the DLP workload
  4. Click Grant admin consent for [your organization].

Client secret​

  1. Go to Certificates & secrets → New client secret.
  2. Add a description and expiration per your policy.
  3. Copy the secret value immediately (shown only once).

2. Enable audit logging (if needed)​

  • Exchange: Enable mailbox audit logging in Exchange Online (on by default for many tenants).
  • SharePoint / OneDrive: Ensure audit logging is enabled in the Microsoft 365 compliance center.
  • Unified audit log: Confirm the unified audit log is turned on for your tenant. New tenants may take up to 12 hours before historical content appears.

3. Perpetual credential​

  1. Log in to Perpetual. Open Settings from the user/org control at the bottom left of the sidebar (click your name → Settings), then go to Credentials → New Credential.
  2. Choose OAuth 2.0 Client Credentials.
  3. Fill in:
FieldValue
NameUnique identifier using letters, digits, and underscores only (e.g. office_365_audit).
Allowed URL patterns*.office.com, *.office365.us, *.microsoftonline.com
Token URLhttps://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
Client IDApplication (client) ID from step 1
Client SecretClient secret from step 1
Scopeshttps://manage.office.com/.default (commercial) or the GCC equivalent for your tenant
  1. Save the credential.

4. Create the Office 365 Audit connector​

  1. Go to Datasets → Connectors → Create Connector.
  2. Select Microsoft Office 365 Audit.
  3. Connector name: unique identifier (letters, numbers, underscores).
  4. Configure:
    • Office 365 Management API access: select the credential from step 3.
    • Poll interval (minutes): default 5.
    • Tenant ID: directory (tenant) GUID from step 1.
    • Region: commercial or gcc — "cannot be changed" after creation.
    • Enable workloads (at least one required):
SettingContent typeNotes
ExchangeAudit.ExchangeMailbox and admin operations
SharePointAudit.SharePointSharePoint and OneDrive file activity
Azure ADAudit.AzureActiveDirectorySign-in and directory admin events
GeneralAudit.GeneralOther workloads (Teams, Power BI, etc.)
DLPDLP.AllRequires ActivityFeed.ReadDlp permission
  1. Optionally check Deploy, then save.

"First run backfills roughly the last 24 hours per enabled workload."

Operational notes​

  • Duplicate workloads: If a workload is already subscribed by another tool or connector in the same tenant, disable it on one side before enabling it here.
  • DLP sensitivity: DLP events may include sensitive data classifications; restrict access accordingly.
  • Secret rotation: Rotate the client secret in Entra, update the Perpetual credential, then remove the old secret.

Reference​