Unfortunately using Microsoft’s own Powershell commands you cannot retrieve the sometimes millions of logs that the users of even a small to medium sized tenant might generate, let alone a larger one. This is the only stable way to retrieve large amounts of logs. This tool works by accessing the Management APIs of Office365 using Rust (collector engine) and Python (everything else). This section gives a brief explanation of the APIs if you just want to get the tool running you can skip it. I will describe it at the end of the article, so you can get an impression of the tool first.Įxample dashboard showing collected event types 1467×1250 126 KB How the tool works: Office365 management APIs To collect Audit logs you need an Azure App Registration with the appropriate permissions this onboarding process is also easy and takes only around 5 minutes. It was designed to be easy to use and should not take too long to get running. In this article I will give a quick overview on how to use the Office365 Audit Log Collector tool to get your full Office365/AzureAD audit trail into Graylog by scheduling to run the tool regularly in a Cron job or Scheduled task. By archiving the audit log trail in Graylog, we own the data it does not disappear after 90 days, and we can take advantage of Graylog’s great dashboards.

It’s an executable that runs on both Windows and Linux. That is why I build an Audit Log collector (in Rust and Python) that that can output all these events into Graylog.

This is especially true of Office365/Azure audit logs, as they expose so much useful data: Azure (failed) logins, Data Loss Prevention events, access to sensitive documents, prevented phishing attempts, etc. Monitoring and archiving audit logs is an essential aspect of security. Collecting Office365 & AzureAD audit logs using Graylog and Office Audit Collector If there’s any questions feel free to ask me here, or create an issue on the Github repo. I’ll explain how it works and how to set it up in the article below. I was asked to create an article on a tool I made for Graylog that collects Office365 and AzureAD audit logs.

Azure ad log