Product Overview
What is M365 Security Plus?
ManageEngine M365 Security Plus is the Microsoft 365 auditing and monitoring component of Log360, our unified SIEM solution. M365 Security Plus helps analyze risks, detect security attacks, and fortify your Microsoft 365 environment's security posture with comprehensive audit reports, instant email alerts, automated content search, and around-the-clock monitoring of service health and performance.
How does M365 Security Plus stand out from the rest?
Granular auditing
Gain access to detailed reports on critical changes and activities like failed logon attempts, file access, role changes, license modifications, and more. Create your own audit profiles to generate specific reports periodically, and to be notified via email.
Real-time alerting
Configure alert profiles to receive instant alerts for critical events, such as changes in password, malware filters, security settings, role assignments, and more. The alerts provide detailed information, such as the severity of the event, alert trigger, time of occurrence, etc.
24x7 monitoring
Stay one step ahead of service failures with around-the-clock monitoring of health and performance of Microsoft 365 features and endpoints. Receive timely alerts on service outages, and get detailed information about the event.
Advanced content search
Perform condition-based and pattern-based searches to identify emails with personal information, such as social security number, login credentials, etc. Identify a potential spear-phishing attack by configuring alerts to notify when an email is sent from an unknown user or unidentified server.
Help desk delegation
Ease IT admin workloads by creating custom roles, and delegating tasks such as auditing, reporting, and monitoring to non-administrative users. Leverage advanced delegation features like cross-tenant, domain-based, attribute-level delegation, and more. Also, track admin or technician activities with the help of audit logs.
Specifications
-Auditing
Exchange Online Auditing
Exchange User Activities
Track activities of mailbox owners, non-owners, and delegates, including mailbox logon activity, send-as right usage, and more.
Exchange Admin Activities
Audit admin activities like mailbox creation and deletion, as well as changes to mailbox permissions, delegates, size, and more.
Mailbox Permission Changes
Retrieve audit details on mailbox permission changes, including information on who made what permission change and when.
Mailbox Property Changes
Audit modified user attributes, like name, phone number, office, department, and more.
Public Folders
View audit details on public folders that were created, modified, or deleted. Audit created, accepted, and denied synchronization and migration requests.
Spam and Malware Detection
Retrieve audit details on messages that are marked as spam, blocked based on content, sent by blocked users, filtered by transport rules, and more.
Mobile Device Auditing
Get audit log details on mobile device configurations, including details on mobile device policies, access level changes, and deleted mobile devices.
Calendar Activities
Audit mailbox calendar settings to see text message settings for calendar events and more.
OWA Activities
Audit OWA mailbox policies, mailbox configurations, OWA calendar settings, and more with the utmost detail.
Azure Active Directory Auditing
User Administration Activities
Get audit details on user creation, modification, and deletion carried out in Azure AD.
License Activities
Closely monitor license changes made in Azure AD to effectively manage your licenses.
Group Administration Activities
View audit details about created, modified, and deleted user groups. Be aware of who makes membership changes in groups.
Password Activities
Audit reset or changed user passwords, modified credentials, and forced password changes.
Role Administration Activities
Track when an admin assigns a user to the admin role, removes a user from the admin role, or modifies company contact information.
User Logon Activities
Keep user login activities in check. Audit successful and failed login attempts made by users with details on the application they used, client IP, and more.
Application Administrative Activities
Audit application admin activities, including when an admin adds or deletes credentials to a service principal, delegation entry, or service principal.
User Property Changes
Audit display name changes, contact information changes, and other user attribute changes.
Group Property Changes
Audit changes to group names, email addresses, and other group attributes.
OneDrive for Business Auditing
File and Folder Activities
Audit created, modified, deleted, renamed, copied, or restored files to closely monitor file and folder changes.
Sharing Activities
View audit details about sharing invitations, company-wide sharing links, anonymous links, access requests, as well as shared files, folders, and sites.
Sync Activities
See which files are uploaded to and downloaded from OneDrive for Business, and which devices are allowed to sync or are blocked from syncing.
Power BI Auditing
Power BI Dashboards
Get real-time auditing details on the dashboards that users have created, viewed, modified, deleted, printed, or shared.
Power BI Reports
Use detailed audit reports to track the Power BI reports that users have created, modified, deleted, exported, printed, or downloaded.
Admin Activities
Audit trial subscriptions, created and deleted Power BI groups, viewed usage metrics, created and deleted organizational content packs, and other admin portal activities.
Microsoft Teams Auditing
Team Events
Track user activity and trends by auditing the creation of teams and channels. Schedule these audit reports and have them automatically emailed to your inbox.
User Logons
Monitor user logon activities to detect forced logons, a common sign of malicious activity, to ensure your organization complies with various industry mandates.
Setting Changes
Identify whether your workplace has been compromised by keeping track of organization, team, and channel setting changes. Run audit reports to see who made what change and when.
SharePoint Online Auditing
File and folder activities
Keep track of file and folder creation, modification, deletion, restoration, downloads, and more with detailed audit reports.
Sharing activities
Monitor access requests, sharing invitations, shared files and folders, company-wide sharing links, anonymous links, and more.
Sync activities
Get a detailed list of devices that are synced to your document library along with details on file uploads, downloads, and changes.
Compliance Management
eDiscovery
Audit eDiscovery administrators and members, viewed and deleted eDiscovery cases, case hold rules, and more.
EOP DLP
View audit information on created, deleted, and modified Data Loss Prevention rules and policies, as well as a list of retrieved sensitive information types.
EOP Users and Groups
See who has viewed and retrieved the list of user objects, group objects, and recipient objects.
-Monitoring
Health and Performance Monitoring
Service monitoring
Monitor the health and performance of Exchange Online, Azure Active Directory, OneDrive for Business, Microsoft Teams, Skype for Business, and other major Microsoft 365 services from a single console.
Endpoint monitoring
Monitor the health and performance of Microsoft 365 service endpoints to keep track of their availability.
Real-time alerts
Monitor Microsoft 365 services and endpoints around the clock, and receive email alerts on service outages in real-time without any delay.
Detailed dashboard
View granular details such as the number of incidents and advisories that are occurring on a service's features and endpoints, how many users will be affected by a particular incident, the current status of each incident, and more.
Historical data
Access historical service health monitoring data that's older then 30 days, which isn't possible using the native reporting tools in the Microsoft 365 portal.
Graphical illustration
View graphs that illustrate the health and performance of your Microsoft 365 services and endpoints.
Search
Content Search
Automate searches
Create search profiles to look through mailboxes at specified intervals automatically. Search across all or selected mailboxes in your Microsoft 365 setup in a single click.
Condition-based and pattern-based searches
Set multiple conditions to filter out the emails you don’t need to view. Use RegEx and commonly used phrases to identify emails with personal information.
Create alerts
No need to login to the tool for periodic updates. With M365 Security Plus receive detailed email alerts about automated search results.
-Delegation
Microsoft 365 Help Desk Delegation
Cross-tenant Delegation
You can configure more than one Microsoft 365 tenant in M365 Security Plus, or delegate the rights of one tenant to another to make sure critical tasks are always taken care of.
Domain-based Delegation
If there are multiple domains in your organization, you can create roles with domain-specific tasks. Having domain-based admins can help you keep a closer eye on your domain.
Technician Audit Log
Track what a technician did with their delegated rights. For example, find out which Active Directory objects they created, modified, and deleted, which reports they generated, which alerts they created, and more.
Security Delegation
Assign security-related tasks such as password resets, account unlocks, blocking users, etc. to one user so they can help keep an eye on your Microsoft 365 environment. Once you've created a role with all the right security-related tasks, delegate that role to a trusted technician to make sure your setup is running smoothly.
Non-admin Delegation
Create and delegate roles to non-admins users. You can delegate miscellaneous tasks such as resetting passwords, changing contact details, etc. to trusted users to reduce help desk tickets. For example, you can delegate the right to update employee details to your organization's HR manager.
Customized Roles
Create custom roles according to your needs. Select any combination of management, reporting, auditing, and alerting tasks to create a role. There's no limit to the amount of roles you can delegate to a technician, which provides flexibility when delegating admin rights to users.
Attribute Level Delegation
Attribute level delegation lets you delegate tasks to users without losing control of your Microsoft 365 setup. Admins are often skeptical about delegating admin rights to users, as things can get out of hand if not properly monitored. To assuage these fears, M365 Security Plus lets you delegate particular tasks rather than giving a person full admin rights.