Key Takeaways
- Microsoft 365 is a top attacker target for email, files and identity, and its activity is invisible to a SIEM unless you connect to its cloud logs.
- Wazuh has an Office 365 module that pulls audit data from the Microsoft 365 Management Activity API: Azure AD sign-ins, Exchange, SharePoint, OneDrive and admin activity.
- Business email compromise (BEC) is the highest-value detection: impossible-travel sign-ins, new inbox forwarding rules, and mass mail or file access after a suspicious login.
- Watch identity and admin changes: risky sign-ins, MFA changes, new privileged role assignments and consent grants to applications.
- M365 logs join your existing SOC, correlated with endpoint and network data in one Wazuh platform instead of a separate console.
Why Microsoft 365 Monitoring Matters
For most organisations, Microsoft 365 is where the business actually operates: email in Exchange Online, documents in SharePoint and OneDrive, and identity in Azure Active Directory (now Entra ID). That concentration of email, data and identity is exactly why it is one of the most attacked platforms, with business email compromise and account takeover among the most common and costly incidents.
The problem is visibility. M365 activity happens in Microsoft's cloud, so it never appears in the on-premise logs a SIEM traditionally reads. Without deliberately collecting M365 audit data, a SOC is blind to phishing-driven account takeover, malicious mailbox rules and data access in the one place attackers most want to be. Wazuh closes that gap with a dedicated Office 365 integration.
Connecting the Wazuh Office 365 Module
Wazuh provides an Office 365 module that collects audit events from the Microsoft 365 Management Activity API. Setup is done on the Microsoft side by registering an application in Entra ID (Azure AD), granting it the API permissions to read management activity, and creating a client secret. Those credentials are then configured in the Wazuh manager's Office 365 module, which polls the API and ingests the events.
Once connected, the module pulls the audit content types that cover the main M365 workloads: Azure AD (sign-ins and directory changes), Exchange (mailbox and transport activity), SharePoint and OneDrive (file access and sharing), and general and DLP audit events. Wazuh decodes these into structured fields and applies rules, so cloud activity flows into the same pipeline as the rest of your telemetry.
Need Help Building These Detections?
Codesecure designs, deploys and tunes Wazuh-based SOC stacks (manager, indexer, dashboard, agents, custom rules, decoders and active response) for businesses across India, Singapore, UAE and Malaysia. ISO/IEC 27001:2022 certified delivery, named OSCP, CEH and CISSP consultants, fixed-price proposals.
See SOC and SIEM Services →What to Collect and Watch
The Management Activity API exposes a lot, so focus on the high-signal activity. From Azure AD / Entra, collect sign-in events (success and failure, location, device, and risk state) and directory changes like new users, role assignments and MFA modifications. From Exchange, collect mailbox activity, especially the creation of inbox and forwarding rules, mailbox permission grants and mass mail operations.
From SharePoint and OneDrive, collect file access, downloads and external sharing events, which reveal data access and exfiltration. From the admin and general audit streams, collect privileged operations, application consent grants and security setting changes. You do not need to alert on all of this, much is kept for context and investigation, but you do need to collect it so the detections and forensic history exist.
Detecting Business Email Compromise
Business email compromise (BEC) is the detection that justifies M365 monitoring on its own. The classic BEC sequence is visible in the audit data: a user is phished, the attacker signs in (often from an unusual country or impossible-travel relative to the real user), and then creates an inbox forwarding or hiding rule to quietly exfiltrate mail and conceal their replies, before sending fraudulent messages or accessing files.
Wazuh can detect each stage. Alert on risky or impossible-travel sign-ins from the Azure AD events, alert strongly on the creation of new inbox forwarding rules (especially forwarding externally), and correlate a suspicious sign-in followed by mailbox rule changes or mass file access as a high-severity BEC pattern. New inbox rules that forward mail externally are one of the single highest-value M365 alerts you can build, because they are both strong evidence of compromise and rare in normal use.
Identity, Admin and Application Threats
Beyond BEC, M365 identity and administration are rich detection ground. Watch for risky sign-ins and MFA changes: an attacker who takes over an account often registers a new MFA method or disables controls to keep access. Alert on new privileged role assignments (such as Global Administrator), which can indicate privilege escalation, and on changes to conditional access or security defaults.
A growing attack path is malicious application consent, where a user is tricked into granting a rogue OAuth application broad permissions to mail and files, giving the attacker persistent access that survives a password reset. Collecting and alerting on application consent grants and new service principals catches this. These identity-centric detections complement BEC and together cover the main ways M365 accounts are abused.
Running Wazuh But Missing Attacks?
Whether you need custom rule development, active response playbooks, a detection coverage review against MITRE ATT&CK, or full tuning, our SOC lead is available for a 30-minute free scoping call. No obligation, no slideware.
Talk to a SOC Engineer →Unified Visibility Across Cloud and On-Premise
The real advantage of monitoring M365 in Wazuh, rather than only in the Microsoft portal, is unification. The same platform that holds your endpoint, server and network telemetry now also holds your cloud identity and email activity. That lets you correlate across boundaries: a suspicious M365 sign-in alongside endpoint activity on the same user's laptop, or data access in SharePoint following a detection on an endpoint.
This unified view is what turns isolated alerts into a coherent incident picture, and it keeps M365 within the same dashboards, rules, cases and compliance reporting as everything else. For a SOC, that is far more effective than pivoting between separate consoles. Mapping M365 detections to MITRE ATT&CK and feeding them into your TheHive case workflow completes the integration, so a cloud account takeover is handled with the same process as any other incident.
Frequently Asked Questions
How does Wazuh monitor Microsoft 365?
Wazuh uses its Office 365 module to collect audit events from the Microsoft 365 Management Activity API. After registering an application in Entra ID (Azure AD) with the right API permissions and a client secret, you configure those credentials in the Wazuh manager. The module then polls the API and ingests Azure AD sign-ins, Exchange, SharePoint, OneDrive and admin activity into Wazuh.
What do I need to set up Wazuh Office 365 monitoring?
On the Microsoft side, register an application in Entra ID (Azure AD), grant it permission to read the Management Activity API, and create a client secret. On the Wazuh side, configure the Office 365 module with the tenant ID, client ID and secret. The module then collects the audit content types for Azure AD, Exchange, SharePoint, OneDrive and general or DLP audit events.
How does Wazuh detect business email compromise?
Wazuh detects BEC by alerting on the stages of the attack in M365 audit data: risky or impossible-travel sign-ins, the creation of new inbox forwarding rules (especially forwarding externally), and a suspicious sign-in followed by mailbox rule changes or mass file access. A new inbox rule forwarding mail to an external address is one of the strongest single indicators of compromise.
What Microsoft 365 events are most important to alert on?
The highest-value alerts are new external inbox forwarding rules, impossible-travel or risky sign-ins, new privileged role assignments such as Global Administrator, MFA method changes on an account, and malicious OAuth application consent grants. These cover business email compromise, account takeover and persistent access, which are the most common and damaging M365 attacks.
Can Wazuh detect malicious OAuth application consent in Microsoft 365?
Yes. By collecting application consent and service principal events from the Management Activity API, Wazuh can alert when a user grants an OAuth application broad permissions to mail and files. This catches consent-phishing attacks, where an attacker gains persistent access that survives a password reset, which is an increasingly common M365 attack path.
Can Codesecure set up Microsoft 365 monitoring in our Wazuh?
Yes. Codesecure configures the Wazuh Office 365 module end to end, including the Entra ID application registration, collection of the right audit streams, and detections for business email compromise, risky sign-ins, mailbox rule abuse, privileged changes and malicious app consent. ISO/IEC 27001:2022 certified delivery with named OSCP, CEH and CISSP consultants across India, Singapore, UAE and Malaysia.
See The Attacks Happening Inside Microsoft 365
Codesecure connects Wazuh to the Microsoft 365 Management Activity API and builds the detections that catch business email compromise, risky sign-ins, mailbox rule abuse and malicious app consent, correlated with the rest of your SOC. Delivered by named OSCP, CEH and CISSP consultants.
