Get in touch
← Sentinel Explorer
↳ GitHub sourceConnector

Microsoft 365 (formerly, Office 365)

View on GitHub ↗Original file ↗

Description

The Microsoft 365 (formerly, Office 365) activity log connector provides insight into ongoing user activities. You will get details of operations such as file downloads, access requests sent, changes to group events, set-mailbox and details of the user who performed the actions. By connecting Microsoft 365 logs into Microsoft Sentinel you can use this data to view dashboards, create custom alerts, and improve your investigation process. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2219943&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Declared status
2
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

OfficeActivity (SharePoint)OfficeActivity (Exchange)OfficeActivity (Teams)

Declared permissions

read and write permissions.
Workspace
Workspace

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Connect Office 365 activity logs to your Microsoft Sentinel.
Select the record types you want to collect from your tenant and click **Apply Changes**.
Exchange
SharePoint
Teams
2. Previously connected tenants
Microsoft Sentinel now enables Office 365 single-tenant connection. You can modify your previously connected tenants and click **Save**.

Related content

Links established from declared identifiers and solution manifests.

Analytics rules45
Accessed files shared by temporary external userLowAnomalous login followed by Teams actionMediumDataverse - Executable uploaded to SharePoint document management siteLowDataverse - Malware found in SharePoint document management siteMediumDataverse - Mass download from SharePoint document managementLowDetecting Impossible travel with mailbox permission tampering & Privilege Escalation attemptMediumEuropium - Hash and IP IOCs - September 2022HighExchange AuditLog DisabledMediumExchange workflow MailItemsAccessed operation anomalyMediumExternal user added and removed in short timeframeLowGreyNoise TI map IP entity to OfficeActivityMediumHigh risk Office operation conducted by IP Address that recently attempted to log into a disabled accountMediumLog4j vulnerability exploit aka Log4Shell IP IOCHighLumen TI IPAddress in OfficeActivityMediumMail redirect via ExO transport ruleMediumMalformed user agentMediumMalicious BEC Inbox RuleMediumMalicious Inbox RuleMediumMercury - Domain, Hash and IP IOCs - August 2022HighMultiple Password Reset by userLowMultiple Teams deleted by a single userLowMultiple users email forwarded to same destinationMediumNew executable via Office FileUploaded OperationLowNew UserAgent observed in last 24 hoursLowNRT Malicious Inbox RuleMediumNRT Multiple users email forwarded to same destinationMediumOffice Policy TamperingMediumOffice365 Sharepoint File transfer above thresholdMediumOffice365 Sharepoint File transfer Folders above thresholdMediumRare and potentially high-risk Office operationsLowSharePointFileOperation via devices with previously unseen user agentsMediumSharePointFileOperation via previously unseen IPsMediumThreat Essentials - Mail redirect via ExO transport ruleMediumThreatConnect TI map Email entity to OfficeActivityMediumThreatConnect TI Map URL Entity to OfficeActivity DataMediumTI map Domain entity to EmailEventsMediumTI map Domain entity to EmailUrlInfoMediumTI map Email entity to EmailEventsMediumTI map Email entity to OfficeActivityMediumTI Map Email entity to OfficeActivityMediumTI map IP entity to OfficeActivityMediumTI Map IP entity to OfficeActivityMediumTI Map URL Entity to OfficeActivity Data [Deprecated]MediumUser agent search for log4j exploitation attemptHigh[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022High
Solutions1
Workbooks6

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
Office365
Additional source files 2Solutions/Microsoft 365/Data Connectors/Microsoft365.JSONsource ↗Solutions/Microsoft 365/Data/Solution_Office365.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.