​
Overview

The Office 365 integration uses the Office 365 Management Activity API to ingest the unified audit log:
  • Audit.Exchange: mailbox access, send-as, transport rule changes
  • Audit.SharePoint: file access, sharing, and permission changes
  • Audit.AzureActiveDirectory: sign-ins and directory changes
  • Audit.General: Teams, Power BI, Forms, and other workloads
  • DLP.All: data loss prevention rule matches

​
Prerequisites

  • A Microsoft 365 tenant with unified audit logging enabled (it is on by default for newer tenants; otherwise enable it from the Microsoft Purview compliance portal).
  • Global Administrator rights to register an Azure AD app and grant admin consent.

​
Step 1: Register an app in Azure AD

  1. Sign in to the Azure portal and open Microsoft Entra ID → App registrations → New registration.
  2. Name it atatus-o365-siem, choose Accounts in this organizational directory only, and click Register.
  3. Copy the Application (client) ID and Directory (tenant) ID from the Overview page.
  4. Open Certificates & secrets → New client secret and copy the secret Value.

​
Step 2: Grant Office 365 Management API permissions

  1. In the same app, open API permissions → Add a permission → Office 365 Management APIs → Application permissions.
  2. Add:
    • ActivityFeed.Read
    • ActivityFeed.ReadDlp
    • ServiceHealth.Read
  3. Click Grant admin consent for <your tenant>.

​
Step 3: Enable subscription content types

The first time you connect, Atatus calls /subscriptions/start for each content type listed above. If you prefer to enable them manually beforehand, run the API calls described in Microsoft’s Management API documentation.

​
Step 4: Connect Office 365 in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Office 365 card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The Office 365 card shows Configured.
  • Audit events appear in Security → Cloud SIEM → Audit Logs → Events with source office365.