Microsoft 365

Collect Microsoft 365 audit and activity logs from the Office 365 Management Activity API, including events from Exchange, SharePoint, OneDrive, Azure Active Directory, and more.

RunReveal polls the Microsoft 365 Management Activity API every 5 minutes to retrieve your organization's audit logs. Logs are available in workload-specific views for easier querying.

Prerequisites

Before connecting Microsoft 365 to RunReveal, you need:

• Access to the Microsoft Entra admin center — or the Azure Government portal for GCC High / DoD tenants — with permission to register applications and grant admin consent.
• Audit (Standard) logging enabled for your tenant in the Microsoft Purview compliance portal.
• Knowledge of which Microsoft cloud your tenant runs in (Commercial, GCC, GCC High, or DoD). This determines the API and login endpoints you configure in Infrastructure.

Access

RunReveal authenticates as an Azure AD application using the client credentials (app-only) flow. Register an application and grant it the following Office 365 Management APIs permissions. Add both the Delegated and Application variants so admin consent can be granted cleanly.

An administrator must click Grant admin consent after adding these permissions for them to take effect.

Infrastructure

RunReveal defaults to the commercial Microsoft 365 endpoints. If your tenant runs in a US Government or sovereign cloud, override the Management API Base URL and Login Base URL when you create the source so RunReveal authenticates and polls against the correct endpoints.

Setup

Step 1: Register an Application

1. Sign in to the Microsoft Entra admin center — or the Azure Government portal for GCC High / DoD — and navigate to Entra ID → App registrations.
2. Click New registration.
3. Enter a name for the application (e.g., RunReveal 365).
4. Under Supported account types, select Accounts in this organizational directory only.
5. Click Register.

Step 2: Create a Client Secret

1. In your new app registration, click Certificates & secrets in the left sidebar.
2. Click New client secret.
3. Enter a description (e.g., RunReveal integration) and set an expiration period.
4. Click Add.
5. Copy the secret Value immediately — it is hidden after you navigate away from this page. This is your Client Secret.

Step 3: Add API Permissions

1. In the left sidebar, click API permissions → Add a permission.
2. Select Office 365 Management APIs and add the Delegated and Application permissions listed in Access.
3. Click Grant admin consent to approve the permissions for your organization.

Step 4: Copy Your Application and Tenant IDs

1. In the left sidebar, click Overview.
2. Copy the Application (client) ID — this is your Client ID.
3. Copy the Directory (tenant) ID — this is your Tenant ID.

Step 5: Connect to RunReveal

1. In RunReveal, navigate to Sources → Add Source.
2. Search for and select Microsoft 365.
3. Fill in the following fields:

4. Click Save.

RunReveal will automatically subscribe to all available Microsoft 365 activity feeds for your tenant. Logs should begin appearing within a few minutes.

Verify It's Working

Once added, the source logs should begin flowing within a few minutes.

You can validate we are receiving your logs by running the following SQL query:

SELECT * FROM runreveal.microsoft365_logs LIMIT 1

Use dot notation on the rawJSON column to access any Microsoft 365-specific field without needing to know the exact JSONExtractString path:

SELECT
    eventTime,
    eventName,
    rawJSON.UserId,
    rawJSON.Workload,
    rawJSON.Operation,
    rawJSON.ResultStatus,
    rawJSON.ClientIP
FROM runreveal.microsoft365_logs
WHERE rawJSON.Workload = 'AzureActiveDirectory'
LIMIT 50

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

• Get started with Office 365 Management APIs — Microsoft's overview of registering an app and consenting to the Management APIs
• Office 365 Management Activity API reference — Reference for the endpoint RunReveal polls
• Enable or disable auditing (Microsoft Purview) — How to turn on audit logging for your tenant
• US Government cloud endpoint mappings — Microsoft's audience/authority table for GCC, GCC High, and DoD
• Microsoft 365 GCC High and DoD service descriptions — Differences for US Government sovereign clouds