Microsoft Office 365

The JSA DSM for Microsoft Office 365 collects events from Microsoft Office 365 online services.

Note:

The Service Communications API endpoint is no longer available for use because it was deprecated by Microsoft.

The following table describes the specifications for the Microsoft Office 365 DSM:

Table 1: Microsoft Office 365 DSM Specifications

Specification	Value
Manufacturer	Microsoft
DSM name	Microsoft Office 365
RPM file name	DSM-Microsoft Office365-JSA_version-build_number.noarch.rpm
Supported versions	N/A
Protocol	Office 365 REST API
Event format	JSON
Recorded event types	Exchange Audit, SharePoint Audit, Azure Active Directory Audit
Automatically discovered?	No
Includes identity?	No
Includes custom properties?	No
More information	Microsoft website

To integrate Microsoft Office 365 with JSA, complete the following steps:

1. If automatic updates are not enabled, download and install the most recent version of the following RPMs from the https://support.juniper.net/support/downloads/ onto your JSA console:

   • Protocol Common RPM

   • Office 365 REST API Protocol RPM

   • Microsoft Office 365 DSM RPM

2. Configure a Microsoft Office 365 account in the Microsoft Azure portal.

3. Add a Microsoft Office 365 log source on the JSA console. The following table describes the parameters that require specific values for Microsoft Office 365 event collection:

   Table 2: Microsoft Office 365 Log Source Parameters

   Parameter	Value
   Log Source type	Microsoft Office 365
   Protocol Configuration	Office 365 REST API
   Log Source Identifier	A unique identifier for the log source. The Log Source Identifier can be any valid value and does not need to reference a specific server. The Log Source Identifier can be the same value as the Log Source Name. If you have configured multiple Microsoft Office 365 log sources, you might want to identify the first log source as MSOffice365-1, the second log source as MSOffice365-2, and the third log source as MSOffice365-3.
   Client ID	In your application configuration of Azure Active Directory, this parameter is under Client ID.
   Client Secret	In your application configuration of Azure Active Directory, this parameter is under Value.
   Tenant ID	Used for Azure AD authentication.
   Event Filter	The type of audit events to retrieve from Microsoft Office. Azure Active Directory Exchange SharePoint General DLP
   Use Proxy	For JSA to access the Office 365 Management APIs, all traffic for the log source travels through configured proxies. Configure the Proxy Server, Proxy Port, Proxy Username, and Proxy Password fields. If the proxy does not require authentication, keep the Proxy Username and Proxy Password fields empty.
   EPS Throttle	The maximum number of events per second. The default is 5000.
   Show Advanced Options	Show optional advanced options for event collection. The Advanced Options values are in effect whether they are shown or not.
   Management Activity API URL	Specify the Office 365 Management Activity API URL. Default is https://manage.office.com.
   Azure AD Sign-in URL	Specify the Azure AD sign-in URL. Default is https://login.microsoftonline.com.