Office 365 Security Monitoring

Application - Office365 - Security Opspack

Office365 is a line of subscription services offered by Microsoft that includes products like Office, SharePoint and Skype for Business.

What You Can Monitor

This Opspack allows you to monitor your Office365 Subscription's Security, providing information on Security Alerts.

We recommend adding the "Application - Office365" - Overview Host Template to your Host when using this template to give you a better overview of your Office365 subscription.

Service Checks

Host Template	Service Check	Description
Application - Office365 - Security	Office365 - Security - Security Alerts	The security status of the Office365 subscription and any alerts

Setup Office365 for Monitoring

To monitor your Office365 environment, you will need to retrieve the following credentials, which will allow Opsview Monitor access to the metrics for your Office365 Subscription:

Tenant/Directory ID
Client/Application ID
Secret Key

Follow the steps below to retrieve this information.

Step 1: Find the Tenant ID

The Tenant/Directory ID can be found in the Azure Active Directory under the Properties section from the Azure dashboard.

Step 2: Find the Client/Application ID for your application

You need to create and register your application if you haven't already. Use the following documentation from Microsoft: Create an Azure Active Directory application

The Client/Application ID can be found in Azure Active Directory under the App registrations section from the Azure dashboard.

Step 3: Generate the Secret Key for your application

You will need to create a Secret Key for your application, once this has been created its value will be hidden so save the value during creation.

To create the Secret Key, select your application from the list, select the Settings within your application and then select the Keys option.

There you can create a new key by adding the description and expiration period and the value will be generated.

Step 4: Add Required Permissions

The appropriate permissions for the APIs used by these Office365 Host-Templates need to be added in Azure. From the same settings menu as above, go to Required Permissions under API ACCESS. Click Add, select the API and then choose the permissions for that API based on the table below.

API	Application Permissions	Delegated Permissions
Microsoft Graph	Read all usage reports Read your organization’s security events	Read all usage reports Read your organization’s security events
Office 365 Management APIs	Read activity data for your organization Read service health information for your organization	Read activity data for your organization Read service health information for your organization

Office 365 Exchange Add Permissions Step 1

Office 365 Exchange Add Permissions Step 2

Setup and Configuration

Step 1: Add the Host Template

Add the Application - Office365 - Security Host Template to your Opsview Monitor host. If the resource you're monitoring has no hostname or public IP, then open the Advanced settings pane and change Host Check Command to Always assumed to be UP.

For more information, refer to Opsview Knowledge Center - Adding Host Templates to Hosts.