Page Comparison

Adding data from Azure Active Directory services requires a creation of an Enterprise Application in the Azure Active Directory portal that will grant API access to XpoLog.
An administrator access to the Azure Active Directory portal is required to create the application and grant it the requited permissions, generate secret key, etc.

...

Azure Active Directory portal side

1. Go to Microsoft Azure portal Portal (https://portal.azure.com/) and login as Administrator.

   Image RemovedImage Added

2. Click on ‘Azure Active Directory’ Icon to open its portal:
   

   Image RemovedImage Added

3. Take a note of your Tenant ID as displayed in this screen:

   

4. Application Creation - On the left navigation panel, Enter to ‘Enterprise Applications', Click the ‘New Application' and then on 'Create your own application’.

   Image RemovedImage Added

5. Give the application a name, check the ‘Non-gallery’ option and click on ‘Create’.

6. After the creation, navigate to 'App registrations' on the left menu, Click the 'New Registration' - name it as your new application (XPLG-ACCESS-AZURE-AD for example) and Register.

   

   
   

   

7. You will be redirected to the Application's portal:
   

   1. Take a note of the Application (client) ID:

      

   2. Application Secret (Authentication) - On the left navigation panel - click 'Certificates & Secrets', add a new client secret and take a note of the created secret value:
      

      Image RemovedImage Added

8. Application Permissions - Enter to ‘API permissions’, Click on Add a permission:

   Image RemovedImage Added

   1. Choose the ‘Office 365 Management APIs’ box and add the following permissions:

   2. Under Delegate (search the below values, select them and click the Add permissions button):

      1. ActivityFeed.Read

      2. ActivityReports.Read

   3. Under Application (search the below values, select them and click the Add permissions button):

      1. ActivityFeed.Read

      2. ActivityFeed.ReadDlp

9. Click on 'Microsoft Graph' and add these permissions:

   1. Under Delegate (search the below values, select them and click the Add permissions button):

      1. AuditLog.Read.All

   2. Under Application (search the below values, select them and click the Add permissions button):

      1. AuditLog.Read.All

10. Make sure to click on ‘Grant admin consent for ____’ button:

    Image RemovedImage Added

11. And the The final permissions view should look as follows:
    

    

...

1. In Add Data pane click on Azure Active Directory. The Source and Collection Setting wizard opens.

   • To change a log source, near Source Type, click on the Change button.

2. Azure connectivity:

   1. In the Client ID, enter your client ID (see above section 9.a. - Application (Client) ID).

   2. In the Client Password, enter your password (see above section 9.b. - client secret value).

   3. In the Tenant ID, enter your tenant ID (see above section 3).

   4. Click verify Verify to ensure connectivity:
      

      Image RemovedImage Added

3. Save and click next Next.

4. In the Time To Retrieve, select the default past time to retrieve data from the selected Azure services.

5. Select the Services you wish to collect data from the available services list (by moving the desired services to the right hand side).

   Image Added

6. Click on the grey box under 'Collection Settings', Open the 'Regional Settings' and change the Log time zone to 'Default [UTC]':

...

7. Click DONE – XpoLog applies will apply an automated pattern on the for each incoming log.Image Removed

...

8. Click SAVE and follow one of the following:
Save & Close – XpoLog saves the new log and points to the logs tree. locate the log in the logs tree and enter the viewer in order to view the log.
Save & Add Another – XpoLog saves the new log and points to Add Log screen so that you may another log.
Optionally, defining the basic information of the new log (see Setting Log General Information).