Skip to main content

Permissions for Microsoft Entra ID Auditing

Auditor audits Office 365 organizations that have established modern authentication as their identity management approach, including support for multi-factor authentication (MFA). See the Microsoft article What is modern authentication for more information on modern authentication.

In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure AD) application with appropriate access permissions. So, you should register an Microsoft Entra ID app and provide its settings to Auditor  when configuring a monitored item.

For Microsoft Entra ID Auditing​

To collect audit data in your cloud-based environment, Netwrix uses a dedicated Microsoft Entra ID application with API access permissions granted to that app. To register such application and assign required permissions, a Microsoft Entra ID account with an administrative role will be required:

  • If Basic Authentication is used:
    • A Microsoft Entra ID application named Netwrix Auditor for Microsoft Entra ID will be created automatically when Netwrix Auditor connects to the monitored item (Office 365 tenant) for the first time. Thus, you will need to prepare a Microsoft Entra ID user account with an administrative role in Microsoft Entra ID —to create an app and perform initial data collection.
    • Provide this user name and password in the monitored item properties. See the Microsoft Entra ID topic for additional information.

See the Using Basic Authentication with Microsoft Entra ID topic for additional information.

  • If Modern Authentication is used:

See the Using Modern Authentication with Microsoft Entra ID topic for additional information.

Permissions for ongoing data collection will depend on data you plan to collect:

  • To collect activity (event-based) data including logon attempts, the administrative role will be needed.
  • To collect activity data without logons, the privileged role can be revoked from the specified account after the initial data collection.

Go back to the Microsoft Entra ID admin center > Applications > App registrations > API permissions and click Grant admin consent for <tenant name>. When prompted to confirm, click Yes.

NOTE: For Office 365 permissions, go to Request API Permissions > APIs my organization users and type "Office 365" in the search bar.

See the following Microsoft article for additional information on how to create an application and service principal using Microsoft Entra ID Admin portal: Create an Microsoft Entra application and service principal that can access resources.

Configure Client Secret​

Step 1 – Go to Manage > Certificates & secrets and click New client secret.

Step 2 – Enter the description. From the expiration options select 24 months.

Step 3 – Click Add.

Step 4 – The new secret will be displayed in the list. Click Copy to clipboard icon on the "Value" parameter on the right side of the screen.

See the following Microsoft article for more information on how to add a client secret: Add a client secret.

Obtain Tenant Name​

Step 1 – Go to Microsoft Entra ID > Overview.

Step 2 – In the Tenant Information section, locate the Primary domain field, copy its value and store to a safe location.