Create profiles to audit Exchange Online mailboxes

Exchange Online is the email service preferred by most organizations around the world. Every organization handles thousands of emails per day, and email is the most vulnerable medium for IT attacks. It is prudent to audit every activity that takes place in your organization's mailboxes, including permission changes, delegate actions, and mailbox movements.

The native tool does not offer a comprehensive audit scheduling option, which necessitates a specialized tool for this purpose. M365 Security Plus, a Microsoft 365 auditing, alerting, and monitoring tool, helps you create your own audit profiles that run automatically and send email notifications to the desired stakeholders at regular intervals.

Why M365 Security Plus?

There are many reasons why organizations opt for M365 Security Plus over the native tool. Here we have explained a few.

• In the Microsoft 365 portal, you have to use the built-in search tool to filter the required data from the audit log each and every time. This takes a lot of time, as the entire audit log has to be scrutinized for the required data. M365 Security Plus provides audit data immediately once a profile is created.
• In the native tool, the retention period to store historic audit data is limited; it depends on the license purchased and used. M365 Security Plus allows you to store audit logs for an indefinite period.
• In M365 Security Plus, you can retrieve audit data for a selected set of users or for users based on group membership, which is not possible in Microsoft 365.
• The audit data can also be filtered based on attribute value and business hours in M365 Security Plus, whereas there is no such option in the native portal.

To create an audit profile for Exchange Online using M365 Security Plus:

1. Click the Settings tab, and navigate to Configuration > Audit Configuration > Audit Profiles.
2. Click Add Profile in the top-right corner.
3. Enter a suitable Profile Name and Description.
4. Under Microsoft 365 Service, select Exchange Online.
5. Choose a Category from the drop-down.
6. Select one or multiple Actions that you want to audit.
7. Under Advanced Configuration > Filter Settings, you can select the Business Hours Filter check box.
8. You can also filter the results of the audits you generate by their columns. Click on the Filter By Column checkbox and modify the fields by which they are filtered. Click the icon to add more conditions. For the successive conditions, use the leftmost drop-down list to decide the logical operator (AND and OR) and define the way in which your search criteria are processed.
9. Click Add when you are done configuring your audit profile.

   

10. Now you will be taken to the Configure Profile page, where you can see the profile you created listed in the table along with the previously created profiles. Click View Report in the Reports column to view the consolidated report.

    

To learn more about how M365 Security Plus helps simplify Microsoft 365 issues, click here.

Highlights of M365 Security Plus

• Schedule your search for content across all Microsoft 365 mailboxes in your organization
• Keep tabs on even the most granular user activities in your Microsoft 365 environment.
• Configure alert profiles in M365 Security Plus to notify you of specific activities that take place outside of business hours or occur at unusual frequencies.
• Delegate granular permissions to technicians without elevating their Microsoft 365 privileges and create custom roles with any combination of reporting, management, and auditing tasks.
• Monitor the health and performance of Microsoft 365 features and endpoints around the clock.