Microsoft 365, formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line
To connect Unified Security Stack with Office365:
1. Open the Azure
Azure’s PortalSelect Microsoft Entra ID.
2. Go to App registrations
3. Add a new app
Clicking the "New registration" button and fill-up the form, with the name "Unified Security Stack O365 Agent", and select the option "Accounts in this organizational directory only to (Single-tenant)" and click on register.
4.In the newly created App registration
Navigate to Certificates & Secrets, then click New client secret to create one. Enter a description. Set the expiration to 730 days (24 months), click Add, and copy the value to a secure location.
5. In the same App registration menu, locate API Permissions and click Add Permissions, then find Office 365 Management API.
6. Choose Application Permissions, then add the ActivityFeed.Read and ActivityFeed.ReadDlp permissions. After that, click Grant admin consent for X and confirm.
7. Within the same Request API Permissions, click Microsoft Graph.
8. Choose Delegated Permissions and add the SecurityAlert.Read.All and SecurityAlert.ReadWrite.All permissions. Then click Grant admin consent for X and confirm.
9. Under Application Permissions, add SecurityAlert.Read.All and SecurityAlert.ReadWrite.All. Next, click Grant admin consent for X and confirm.
10. Go to https://compliance.microsoft.com and sign in.
11. From the left navigation pane in the compliance portal, select Audit.
If auditing is not enabled for your organization, a banner appears asking you to start recording user and admin activity.