Skip to main content

Permissions for Microsoft Entra ID Auditing

With Auditor, you can audit Office 365 organizations that have established modern authentication as their identity management approach, including support for multi-factor authentication (MFA). For more information about modern authentication, see What is modern authentication.

In this scenario, a pre-configured Microsoft Entra ID (formerly Azure AD) application with appropriate access permissions authenticates Netwrix Auditor, which then accesses the cloud-based infrastructure via Microsoft Graph and other modern APIs. So, you should register an Microsoft Entra ID app and provide its settings to Auditor when configuring a monitored item.

For Microsoft Entra ID Auditing​

To collect audit data in your cloud-based environment, Netwrix uses a dedicated Microsoft Entra ID application and the API access permissions granted to that app. To register this application and assign the required permissions, you need a Microsoft Entra ID account with an administrative role:

  • If Basic Authentication is used:
    • Netwrix Auditor automatically creates a Microsoft Entra ID application named Netwrix Auditor for Microsoft Entra ID when it connects to the monitored item (Office 365 tenant) for the first time. Thus, you will need to prepare a Microsoft Entra ID user account with an administrative role in Microsoft Entra ID — to create an app and perform initial data collection.
    • Provide this user name and password in the monitored item properties. See the Microsoft Entra ID topic for additional information.

See the Using Basic Authentication with Microsoft Entra ID topic for additional information.

  • If Modern Authentication is used:

See the Using Modern Authentication with Microsoft Entra ID topic for additional information.

Permissions for ongoing data collection will depend on data you plan to collect:

  • To collect activity (event-based) data, including logon attempts, you need the administrative role.
  • To collect activity data without logons, you can revoke the privileged role from the account after the initial data collection.

Go back to the Microsoft Entra ID admin center > Applications > App registrations > API permissions and click Grant admin consent for <tenant name>. When prompted to confirm, click Yes.

NOTE: For Office 365 permissions, go to Request API Permissions > APIs my organization uses and type "Office 365" in the search bar.

See the following Microsoft article for additional information on how to create an application and service principal using Microsoft Entra ID Admin portal: Create an Microsoft Entra application and service principal that can access resources.

Configure Client Secret​

Create a new client secret to be used by the app.

Step 1 – Go to Manage > Certificates & secrets and click New client secret.

Step 2 – Enter the description. From the expiration options select 24 months.

Step 3 – Click Add.

Step 4 – The new secret will be displayed in the list. Click Copy to clipboard icon on the "Value" parameter on the right side of the screen.

See the following Microsoft article for more information on how to add a client secret: Add a client secret.

Obtain Tenant Name​

Step 1 – Go to Microsoft Entra ID > Overview.

Step 2 – In the Tenant Information section, locate the Primary domain field, copy its value and store to a safe location.