Overview

The Office 365 integration uses the Office 365 Management Activity API to ingest the unified audit log:

• Audit.Exchange — mailbox access, send-as, transport rule changes
• Audit.SharePoint — file access, sharing, and permission changes
• Audit.AzureActiveDirectory — sign-ins and directory changes
• Audit.General — Teams, Power BI, Forms, and other workloads
• DLP.All — data loss prevention rule matches

Prerequisites

• A Microsoft 365 tenant with unified audit logging enabled (it is on by default for newer tenants; otherwise enable it from the Microsoft Purview compliance portal).
• Global Administrator rights to register an Azure AD app and grant admin consent.

Step 1: Register an app in Azure AD

1. Sign in to the Azure portal and open Microsoft Entra ID → App registrations → New registration.
2. Name it atatus-o365-siem, choose Accounts in this organizational directory only, and click Register.
3. Copy the Application (client) ID and Directory (tenant) ID from the Overview page.
4. Open Certificates & secrets → New client secret and copy the secret Value.

Step 2: Grant Office 365 Management API permissions

1. In the same app, open API permissions → Add a permission → Office 365 Management APIs → Application permissions.
2. Add:
   • ActivityFeed.Read
   • ActivityFeed.ReadDlp
   • ServiceHealth.Read
3. Click Grant admin consent for .

Step 3: Enable subscription content types

The first time you connect, Atatus calls /subscriptions/start for each content type listed above. If you prefer to enable them manually beforehand, run the API calls described in Microsoft's Management API documentation.

Step 4: Connect Office 365 in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Office 365 card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The Office 365 card shows Configured.
• Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source office365.