How to Monitor Your Office 365 Tenant, Exchange & SharePoint Logs

To monitor Office 365 with Wazuh, register an application in Azure AD with log-read permissions, configure the office365 module in the Wazuh Manager with your credentials and create custom rules to detect logins from disallowed countries, massive failed sign-ins and file deletions in SharePoint.

How do you monitor Office 365 with Wazuh in real time?

Migrating to the cloud with Office 365 has brought flexibility, but also new attack vectors. Without centralized monitoring, critical events such as anomalous access from abroad, massive login attempts or file deletion in SharePoint go unnoticed. The solution is to integrate Office 365, Exchange and SharePoint logs into Wazuh, turning scattered data into actionable alerts against phishing, account compromise and data loss.

What is the real use case for integrating Office 365 with Wazuh?

A company based in Spain noticed strange activity in its SharePoint. After investigating with Wazuh, they discovered that a user account had been compromised through a phishing email. The attacker, from an IP in a country with no operations, accessed the account and mass-deleted critical documents from a SharePoint library. Thanks to the custom rules, the SOC received an alert within minutes, allowing them to revoke access, reverse the deletion and contain the threat before it spread.

What do you need to monitor Office 365 with Wazuh?

• Office 365 tenant with global or security administrator permissions.
• Wazuh Manager (version 4.3 or higher) installed and operational.
• Access to Azure Active Directory to create an app registration.
• Wazuh agent installed on a server with connectivity to the Microsoft Graph API.

How do you configure the Office 365 integration in Wazuh step by step?

The first step is to register an application in Azure AD so Wazuh obtains log-read permissions. Then you configure the Office 365 module in the Wazuh Manager.

# 1. On the Wazuh Manager server, edit the module configuration file
sudo nano /var/ossec/etc/office365.conf

# 2. Insert the basic configuration with your credentials
<office365>
  "app_id": "YOUR_APPLICATION_ID",
  "app_secret": "YOUR_SECRET",
  "tenant_domain": "yourdomain.onmicrosoft.com"
</office365>

Then, enable and restart the integrator module in the manager.

sudo systemctl restart wazuh-integratord

Which rules should you create to detect anomalous access in Office 365?

With the logs flowing, you create custom rules in Wazuh. For example, to detect access from outside the country, you analyze the 'location' field of the sign-in logs. For mass deletion in SharePoint, you monitor the 'FileDeleted' operation.

<!-- Example rule to detect access from a list of disallowed countries -->
<group name="office365,attack,">
  <rule id="100100" level="10">
    <if_sid>87000</if_sid>
    <field name="office365.UserId">.+</field>
    <field name="office365.location.country" negate="yes">ES|PT|FR|DE</field>
    <description>Office 365 access from an unusual location: $(office365.location.country)</description>
  </rule>
  <!-- Rule for many failed login attempts -->
  <rule id="100101" level="12" frequency="10" timeframe="300">
    <if_matched_sid>100100</if_matched_sid>
    <same_field>office365.UserId</same_field>
    <description>Multiple anomalous access attempts for the account: $(office365.UserId)</description>
  </rule>
</group>

These rules will generate alerts in the Wazuh dashboard, enabling fast investigation and immediate response.

What are the best practices for monitoring Office 365 with Wazuh?

Treat the Azure AD app registration as a privileged credential: scope it to read-only audit-log permissions, store the client secret in a vault rather than in plain text, and rotate it at least every 90 days. Because the office365 module polls the Microsoft Graph API, a single misconfigured tenant domain or expired secret silently stops ingestion, so add a Wazuh rule that alerts when no Office 365 events have arrived for a defined window — this catches a broken pipeline before an attacker exploits the blind spot.

On the detection side, build your country allow-list around where your business actually operates and review it quarterly as teams travel or new offices open. Layer the frequency-based rule (10 failed attempts in 300 seconds) on top of the geolocation rule so that a single anomalous login escalates only when it is part of a pattern, keeping false positives low. Finally, pair these alerts with an active response or a documented SOC playbook — revoke the session, force a password reset and review SharePoint version history — so the few minutes Wazuh buys you are not wasted deciding what to do.

Conclusion

Proactive monitoring of Office 365 with Wazuh is no longer a luxury, it is a cybersecurity necessity. Centralizing logs from Exchange, SharePoint and general activity lets you detect attack patterns such as phishing, brute-force login attempts and data leaks or deletion. Turn the massive amount of data from your tenant into actionable intelligence, strengthening your cloud security posture. Need help implementing this solution in your organization? Request a free consultation with our experts.

Frequently Asked Questions

How do you monitor Office 365 with Wazuh?

Register an application in Azure AD with log-read permissions, configure the office365 module in the Wazuh Manager with the app ID, secret and tenant domain, then create custom rules to detect logins from disallowed countries, massive failed sign-ins and file deletions in SharePoint.

What Wazuh version is needed to integrate Office 365?

The native office365 module requires Wazuh Manager 4.3 or higher. You also need a Wazuh agent on a server with outbound connectivity to the Microsoft Graph API and an Azure AD app registration with audit-log read permissions.

Which Office 365 events should you alert on first?

Prioritize sign-ins from countries where you have no operations, ten or more failed login attempts within a five-minute window, and the FileDeleted operation in SharePoint. These three cover the most common phishing, brute-force and data-loss scenarios.

Can Wazuh detect a compromised Office 365 account in real time?

Yes. With the office365 module ingesting sign-in and audit logs and frequency-based correlation rules in place, Wazuh raises an alert within minutes of anomalous activity, which is often enough time to revoke the session and contain the breach before data is exfiltrated.

Does monitoring Office 365 with Wazuh add a license cost?

No. Wazuh is open source and ingests the audit logs your tenant already produces, so there is no per-seat fee. You only need an Office 365 plan that exposes the unified audit log and the infrastructure to run the Wazuh Manager.