Microsoft 365 Management Activity is an audit activity feed for Microsoft 365. It reports the actions that users, administrators and policies take across Microsoft 365 services, including the email messages that users send. This guide walks you through the steps to gather the necessary information and configure a Microsoft app registration for the purpose of creating a Microsoft 365 Management Activity Email Security integration.
Before you begin, ensure that you have:
- Access to the Microsoft Entra admin center with a role that can create an app registration, grand admin consent, and change the audit settings for the organization.
- Auditing turned on for your Microsoft 365 organization
- Consult the Microsoft documentation if needed
| Application Permission | Purpose |
|---|---|
ActivityFeed.Read | Read the audit activity feed of the organization. This permission covers the Send, SendAs and SendOnBehalf audit operations. |
ActivityFeed.ReadDlp | Read the data loss prevention (DLP) part of the same feed, required to retrieve attachment information and MipLabels. |
- Sign in to the Microsoft Azure portal. Use an account that can create an app registration and grant admin consent
- Navigate to App Registrations
- Select New registration
- Fill in the field titled Name
- In the section titled Supported account types, select the single tenant option
- Leave the field titled Redirect URI empty
- Select Register
- On the Overview page, take note of the Application (client) ID and the Directory (tenant) ID. Store both values in a safe location
- Select API permissions from the sidebar on the left
- Select Add a permission
- Select the Microsoft APIs tab, then select Office 365 Management APIs
- Select Application permissions
- Add all of the required permissions. See the section above titled Required Permissions
- Select Add permissions
- Select Grant admin consent, then confirm the dialog that appears
- In the Configured permissions table, examine each permission. The Type column must read Application. The Status column must show that your organization granted consent
- Note: The integration runs without a signed-in user, so a delegated permission does not work
- You have now registered an application. Proceed to the next section titled Generating Credentials
For more information on app registrations, see the Microsoft Quickstart: Register an application docs page.
- In the application registration, select Certificates & secrets from the sidebar on the left
- Select the Client secrets tab, then select New client secret
- Fill in the field titled Description
- Select a value for the field titled Expires
- Note: A client secret has a maximum lifetime of 24 months. The integration stops when the secret expires. Record the expiry date and replace the secret before that date
- Select Add
- Take note of the value in the Value column and store it in a safe location
- Note: The portal shows two columns, Secret ID and Value. The integration needs the Value. The portal shows the Value only on this page, and does not show it again
- You have now created a client secret. Proceed to the next section titled Configuring the Integration
For more information on client secrets, see the Microsoft Add and manage app credentials docs page.
To configure a new Microsoft 365 Management Activity integration, provide each of the values as defined below:
| Integration Parameter | Description |
|---|---|
| Tenant ID | This is the Directory (tenant) ID value from the Overview page of the application registration. Example: f81d4fae-7dec-11d0-a765-00a0c91e6bf6 |
| Client ID | This is the Application (client) ID value from the Overview page of the application registration |
| Client Secret | This is the Value of the client secret from the steps above. It is not the Secret ID |
| Cloud (Optional) | This is the Microsoft 365 cloud that hosts your organization. |
| Operations (Optional) | These are the Exchange audit operations that the integration reports. The choices are Send, SendAs, SendOnBehalf and MipLabel. By default, Microsoft 365 Management Activity integrations report all four. Remove MipLabel to report send events only |
- Turn auditing on or off - learn how to enable auditing in your organization.
- Manage mailbox auditing - learn how to manage mailbox auditing in your organization.
- Search for mailbox activities performed by users with non-E5 licenses - learn how to manage auditing for mailboxes that don't have E5 licenses.