Skip to main content
Skip table of contents

(LRCloud Only) Configure Office 365 Message Tracking Using Cloud to Cloud

Office 365 Message Tracking is a collection of metadata about email messages sent and received within an organization, containing information such as:

  • Sender and Recipient
  • Subject
  • Size
  • Status (for example, pending or delivered)

In addition to auditing, these logs can help identify messages with delayed or failed delivery.

The System Monitor Agent can import Office 365 Message Tracking logs into LogRhythm for analysis. This document explains how to configure the collection of Office 365 Message Tracking logs using the web console's cloud to cloud functionality. This is available to LRCloud customers only.


Before you start to configure collection from O365, you must ensure the following:

  • Customer is an LRCloud customer that has their environment hosted.
  • You have a valid username and password for connecting to the Office 365 reports API.
  • Correct permissions or role in O365 to use message trace search.

Initialize the Logs Source

  1. Log into the web console as an Restricted Administrator User.
  2. On the top navigation bar, click the Administration icon, and select Cloud Log Collection.
  3. At the top of the page, click New Log Source.
  4. Select the tile for Office 365 Message Tracking Sysmon Agent.
    The Add Office 365 Message Tracking Log Source screen appears.
  5. Enter the following details:

    NameEnter the name for this log source.
    Description(Optional) Enter a description for this log source.

    Enter the username of the Office 365 Admin account. If the username is an email account, be sure to include the full address.

    PasswordEnter the password to the above Office 365 Admin account.
  6. Click Save

Using the information provided, a new active log source is created and accepted in the client console. Collection should start automatically within a couple of minutes.

The log source's host is the Platform Manager. However, it is recommended that a new host entity is created and the log source is moved to the new host. This is done in the log source properties screen, not from the log source grid.

For security purposes, the values entered are encrypted using LRCrypt.

Default Config Values for Office 365 Message Tracking Log Source

SettingDefault Value
Delay60 minutes
Window60 minutes
Frequency300 seconds
Timeout300 seconds
ErrorRetryTimeSpan60 minutes
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.