Office 365

To receive logs from the Microsoft Cloud, it is necessary to open a TCP port that will be accessible from the whole Internet (Microsoft does not define ranges of IP networks from which it sends logs).

For this purpose, TCP port 8443 is set up in Logmanager - on this port, only the application receiving O365 events is listening and nothing else is accessible. There is no risk in exposing this port to the Internet.

Port 8443 located at Logmanager can be propagated to the Internet through your firewall on any available port of your choosing. The service listening on this port only accepts requests on the /wh/o365/ endpoint, and only the HTTP GET and POST methods - it returns HTTP error status code 400 for any other request.

The O365 service is not automatically started until the configuration of the application on the MS cloud is set and stored according to the document below.

How log collect from O365 works:

Microsoft will send notify information on port 8443 Logmanager with IDs of audit events. If Logmanager is not available at this time, Microsoft will automaticaly try to send this information later.
Logmanager will take received ID of audit events and download it from Microsoft. If Microsoft site is not available, it will try it automaticaly later.
Logmanager will automaticaly renew API tokens every month.

For a functioning collection of audit events, it is necessary that Logmanager is having unlimited access on port 443 to the entire internet! Microsoft unfortunately does not have any static IP pools defined, at which events/API tokens may be placed.

Access to Microsoft servers requires transparent communication, i.e. without HTTPS/SSL inspection. Check your firewall settings to see if you are blocking communication or if you have HTTPS/SSL inspection (also known as MITM, or Man in the middle) enabled. If your firewall allows it, create a special unique rule for Logmanager to allow only the traffic you want.

The O365 component receives audit event notifications from Microsoft via a secured endpoint (HTTPS). From August 2026, Microsoft requires a certificate issued by a publicly trusted certificate authority, including the full certificate chain, matching the domain specified in the Redirect URI setting, with an RSA key type of 2048 or 3072 bits.
The certificate does not have to be deployed directly on Logmanager - the TLS connection can also be terminated on an upstream reverse proxy, as long as Microsoft sees a publicly trusted certificate with a full chain on that connection.
If the certificate is deployed on a reverse proxy, it is important to keep the TLS 1.2 protocol enabled as well (do not restrict it to TLS 1.3 only).
If you need to change the Redirect URI value (e.g. due to a certificate/domain change), follow the Change Redirect URI chapter.

See more about Office 365 APIs at https://docs.microsoft.com/en-us/office/office-365-management-api/get-started-with-office-365-management-apis

Registration component O365 in Microsoft Entra

This document describes how to configure the Microsoft O365 cloud to send audit events to Logmanager system.

Make sure you have audit logging in Office 365 enabled, you can use this manual https://docs.microsoft.com/en-us/office/office-365-management-api/troubleshooting-the-office-365-management-activity-api#enabling-unified-audit-logging-in-office-365. Audit logging should be enabled automaticaly when you start using O365 service. If auditing is not enabled, registration from Logmanager will end with the following error message from the O365 cloud: ‘Tenant <tenantID> does not exist’.

In Logmanager, within the O365 component settings, fill in the Public URL for O365 log receive (Logmanager inside the network always listens on port 8443, though your firewall may expose any port externally. However, you must enter the full domain name of your public IP and the correct external port on which Logmanager will be accessible from the internet). After saving the form, press F5 to reload data from the Logmanager database.
Open Microsoft Entra admin center: https://entra.microsoft.com/#home
In the left panel, click Show more and open Identity.
Next, select Applications and App registrations, then click New registration.

Application registration
In the form, enter a custom name for the application. Each application you use should have a unique name. You will need to provide this value in the registration form for the Logmanager O365 UI component. In the supported account types, select the second option to allow access from any type of account.
- If you plan to collect logs from more organizations, select option „Accounts in any organizational directory“.
- If you are planning to collect logs only for your organization choose option „Accounts in this organizational directory“.
In Logmanager, copy the value of the Public URL for O365 log receive and paste it into the Redirect URI field in the form on the Microsoft website, then click Register.

Application registration
Navigate to Identity / Roles & admins / Roles & admins, enter Global Reader in the search field, and click the role that appears.

Setting the Global Reader role
Click Add assignments, search for the logmanager application created in the previous step, select it, and click the Add button.

Setting the Global Reader role
Go to Identity / Applications / Enterprise applications, where you can now see the Logmanager application. Click it, and on the newly opened Overview page, copy the Application ID and paste it into the Logmanager GUI.

Application ID

Application ID
Now, you need to grant the newly created application permissions to read logs in the MS web console. Go to Identity / Applications / App registrations, click All applications, and select the Logmanager application.

API permissions
Next, click API permissions in the left menu, then click Add a permission and select Office 365 Management APIs from the list.
On the newly opened page, click Delegated permissions and check all the permissions. Then, click Application permissions and again add all available permissions. Finally, click the Add permissions button.

API permissions
In the next step, it is necessary to approve these new permissions by an administrator. Click Grant admin consent, as shown in the image:

API permissions
Once the permissions are approved, everything should turn green:

API permissions
Next, on the Microsoft page, click Certificates & secrets and generate a new New client secret:

Certificates and secrets
Copy the generated secret key value to your clipboard.

Certificates and secrets
In Logmanager, paste the secret key value into the O365 Application key field, save the form, and refresh the page. Then, click the Verify that LM is accessible from internet button. A new webpage will open, which will use the Logmanager manufacturer’s web server to verify that the O365 component is accessible from the internet.

Certificates and secrets

The service is available only after saving the complete configuration of ID, key and public URL. If the test website tells you that the component is not available, please verify that you have entered the correct URL, Firewall penetration, filled in all form values.

It is also necessary to register a new tenant for reading logs from MS (please continue only if you passed test of Logmanager public component availabilty from the Internet!). In the GUI Logmanager, just click the button Register a new tenant at Microsoft.

If the test website tells you that the component is invalid, refresh the Logmanager website using control-F5.

It should look similar to this:

or in JSON format command:

  {
    "content": [
      {
        "contentType": "Audit.AzureActiveDirectory",
        "webhook": {
          "expiration": "",
          "status": "enabled",
          "address": "https://demo.logmanager.cz:8443/wh/o365/",
          "authId": "o365_logmanager_H4SB13"
        },
        "status": "enabled"
      },
      {
        "contentType": "Audit.Exchange",
        "webhook": {
          "expiration": "",
          "status": "enabled",
          "address": "https://demo.logmanager.cz:8443/wh/o365/",
          "authId": "o365_logmanager_H4SB13"
        },
        "status": "enabled"
      },
      {
        "contentType": "Audit.General",
        "webhook": {
          "expiration": "",
          "status": "enabled",
          "address": "https://demo.logmanager.cz:8443/wh/o365/",
          "authId": "o365_logmanager_H4SB13"
        },
        "status": "enabled"
      },
      {
        "contentType": "Audit.SharePoint",
        "webhook": {
          "expiration": "",
          "status": "enabled",
          "address": "https://demo.logmanager.cz:8443/wh/o365/",
          "authId": "o365_logmanager_H4SB13"
        },
        "status": "enabled"
      },
      {
        "contentType": "DLP.All",
        "webhook": {
          "expiration": "",
          "status": "enabled",
          "address": "https://demo.logmanager.cz:8443/wh/o365/",
          "authId": "o365_logmanager_H4SB13"
        },
        "status": "enabled"
      }
    ],
    "msg": "Tenant registration result tenant_id: 6a98b5da-7b3c-4486-bb0b-66a048c6da62",
    "registeredContent": {
      "Audit.AzureActiveDirectory": "enabled",
      "Audit.SharePoint": "enabled",
      "Audit.General": "enabled",
      "Audit.Exchange": "enabled",
      "DLP.All": "enabled"
    },
    "result_subscribe_content": [
      {
        "Audit.AzureActiveDirectory": "OK"
      },
      {
        "Audit.Exchange": "OK"
      },
      {
        "Audit.SharePoint": "OK"
      },
      {
        "Audit.General": "OK"
      },
      {
        "DLP.All": "OK"
      }
    ],
    "status": "OK"
  }

Upon successful registration, you will see a page with the text output of the registration process (JSON data that represents Microsoft cloud.)
After registration, you need to manually set your organization name/domain at Logmanager menu Sources => O365. Edit newly created tenant without any domain and set it to your domain name

O365 tenant edit
In the end, you should see also the new tenant in Logmanager menu

O365 tenants

Setting your domain name will automatically add this information to all logs received from O365 tenant to field meta.src.host.

If, when trying to register a new tenant (new domain), it gives a permission error, it is necessary to verify that the created application has the correct permissions set in such a way that other tenants can read data through it. This can only be found at the following link (the new MS Web UI does not provide this information): https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/Overview/appId/ where application ID is required. On this page, look for: Supported account types, which must be filled in: All Microsoft Account Users.

Other O365 audit options can be found here: https://docs.microsoft.com/cs-cz/microsoft-365/compliance/enable-mailbox-auditing

See the following links for more details:

You can limit source IP addresses that comunicate to Logmanager from the internet using this guide from Microsoft.

https://docs.microsoft.com/en-us/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide

Debugging registration problems

If registering a tenant fails, the page returned by the Register a new tenant at Microsoft button shows only a generic message:

Registration failed; see the O365 component logs for guidance. Check O365 component documentation for more details.

For security reasons the actual cause is not shown on that public page - it is recorded in the O365 component logs in Logmanager. To view them, open Analysis → Discover, select the vendor-internal index pattern, and search:

meta.src.program:"logmanager.component-o365"

Filtering the O365 component logs in Discover

If the failure happened more than a few minutes ago, widen the time range in the top-right time picker.

The most common causes and how to fix them:

Log message	Cause	Fix
`AADSTS7000215: Invalid client secret provided`	The O365 Application key is wrong or expired. A frequent mistake is pasting the secret ID (a GUID) instead of the secret value.	Generate a new client secret (steps 14-16) and paste its value into O365 Application key, then save and reload (Control-F5).
`Tenant <tenantID> does not exist`	Unified audit logging is not enabled in the tenant, or admin consent for the Office 365 Management APIs was not granted.	Enable unified audit logging and grant admin consent (step 12).
`AADSTS50011` (redirect URI mismatch)	The Public URL for O365 log receive does not match the Redirect URI registered in Microsoft Entra.	Make the two values identical (steps 1 and 5).
`AADSTS700016` / `AADSTS90002` (application/tenant not found)	The Application ID is wrong, or the app is not available to other tenants.	Re-check the Application ID (step 8) and that Supported account types allows other tenants.

If you changed the Application ID or O365 Application key, save the form and reload the page (Control-F5) before registering again, so the new values take effect.

Change Redirect URI

If the Logmanager public address changes (e.g. due to a certificate or domain change), the Redirect URI value must be changed as well. Follow these steps:

In Logmanager, in the O365 component settings, update the Public URL for O365 log receive field to the new value (the full domain name and the correct external port on which Logmanager will be accessible from the internet). After saving the form, press F5 to reload data from the Logmanager database.
In the Microsoft Entra admin center (https://entra.microsoft.com/#home), go to Identity / Applications / App registrations and open the registered Logmanager application. In the left menu, click Authentication, add a new Redirect URI value matching the new Logmanager public address, and remove the old (no longer valid) value.
In Logmanager, go to the Sources / O365 / List menu, find the organization (tenant) that used the original Redirect URI, and delete it.
On the application page in Microsoft, go to Certificates & secrets. Either use the existing valid client secret, or generate a new one by clicking New client secret and copy the generated value to your clipboard.

Certificates and secrets

Certificates and secrets
In Logmanager, go to the Sources / O365 / Global settings menu, paste this value into the O365 Application key field, save the form, and refresh the page. Then click the Verify that LM is accessible from internet button and confirm that the O365 component is accessible from the internet at the new address.

Certificates and secrets
In the Logmanager GUI, click the Register new tenant at Microsoft button and register the new tenant.

O365 Tenant Configuration
After successful registration, in Logmanager, in the Sources menu, edit the newly created tenant (shown without a domain) and set it to your organization/domain name.

O365 tenant edit
Finally, you should see the new tenant with your domain in the Logmanager menu and have access to view the latest O365 logs.

O365 tenants