Pre-requisites for Monitoring Office 365 Environments where Basic Authentication is Enabled

If Basic Authentication is enabled in your environment, then the following pre-requisites apply:

  1. The following modules/packages are required on the eG agent host:

    • A 64-bit version of the Microsoft Online Services Sign-in Assistant for IT Professionals RTW;
    • A 64-bit version of the Microsoft Azure Active Directory Module for Windows PowerShell;
    • Exchange Online Management Module, which is essential for monitoring Exchange Online;
    • SharePoint Online Management Shell, which is key for monitoring SharePoint Online;
    • Network Assessment Tool, which helps with Microsoft Teams / Skype for Business Online monitoring;
    • Microsoft Teams Module, which is important for Microsoft Teams monitoring;

    You can manually install these modules/packages on the eG agent host. To know how, refer to theManually Installing Packages/Modules Required for Monitoring Office 365 Environmentstopic.

    Alternatively, you can use the proprietary PowerShell script that eG Enterprise provides to automatically install the above-mentioned modules/packages on the eG agent host. To know which script to use and how, refer to theAutomatically Fulfilling Pre-requisites in a Basic Authentication-Enabled Environmenttopic.

  2. The eG agent runs Powershell cmdlets to pull many of the metrics related to Office 365 and its services. The eG agent requires certain permissions to run these cmdlets. These permissions vary according to the Office 365 service being monitored (i.e., the monitoring model in use).

    The table below describes these privileges:

    Monitoring model

    Permissions

    Microsoft Office 365

    A user who is vested with the View-Only Audit Logs permission

    Microsoft Exchange Online

    A user who is vested with the View-Only Audit Logs, View-Only Recipients, Mail Recipients, and Mailbox Import Export permissions

    Microsoft SharePoint Online and Microsoft OneDrive for Business

    A user who has been assigned the Service support admin and SharePoint admin roles and is vested with the View-Only Audit Logs permission

    Microsoft Teams

    A user who has been assigned the Service support admin role and is vested with the View-Only Audit Logs and Team administrator permissions

    To run tests that use Webhooks for collecting call quality analytics, a user who is assigned the User.Read.All Delegated Permission and the CallRecords.Read.All Application Permission, is required.

    Microsoft Yammer

    A user who has been assigned the Service support admin role and is vested with the user_impersonation permission

    You can manually create a new user in Office 365 and assign all the aforesaid permissions to that user, or can simply pick an existing user and grant him/her the permissions mentioned above. The procedure to achieve this manually are detailed in theCreating a New User in the Office 365 Portaltopic.

    Alternatively, you can use the proprietary Powershell script that eG Enterprise provides for this purpose. The script can be used to automatically create a new user and instantly assign the requisite permissions to that user, or grant the permissions to an existing user in a click. To know what script to use and how to use it, refer to theAutomatically Fulfilling Pre-requisites in a Basic Authentication-Enabled Environmenttopic.

  3. To enable the eG agent to monitor service health, Message Center communications, channels, chats, Teams communication, Yammer, and user activity, the Microsoft GraphApp needs to be registered on Azure Active Directory (AD), with the permissions listed in the table below:

    Permission Type

    API 

    Permissions

    Purpose

    Application Permissions

     

     

     

    Microsoft Graph 

     

     

     

    Calendars.ReadWrite

    Allows app to read and write calendars in all mailboxes

    Reports.Read.All

    Allows app to read all usage reports

    ServiceHealth.Read.All

    Allows app to read service health

    ServiceMessage.Read.All

    Allows app to read service messages

    User.Read.All

    Allows app to read the full profile of all users

    Mail.ReadWrite

    Allows app to read and write mail in all mailboxes

    Mail.Send

    Allows app to send mail as any user

    Channel.ReadBasic.All

    Allows app to read all channel names and channel descriptions, without a signed-in user

    Delegated Permissions

     

     

     

     

     

     

     

     

     

     

     

     

     

     

    Microsoft Graph

     

     

     

     

     

     

     

     

     

     

     

     

    Channel.Create

    Allows app to create channels

    ChannelMember.ReadWrite.All

    Allows app to add and remove channel members

    ChannelMessage.Read.All

    Allows app to read user channel messages

    ChannelMessage.Send

    Allows app to send channel messages

    ChannelSettings.ReadWrite.All

    Allows app to read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.

    Chat.Create

    Allows app to create chats

    Chat.ReadWrite

    Allows app to read and write user chat messages

    ChatMember.ReadWrite

    Allows app to add and remove chat members

    ChatMessage.Send

    Allows app to send user chat messages

    Directory.ReadWrite.All

    Allows app to read and write data in your organization's directory, such as users, and groups

    Team.Create

    Allows app to create teams

    TeamMember.ReadWrite.All

    Allows app to add and remove members from teams, on behalf of the signed-in user.

    TeamSettings.ReadWrite.All

    Allows app to read and change all teams' settings, on behalf of the signed-in user.

    User.Read.All

    Allows app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.

    Microsoft Yammer API

     

    access_as_user

    Allows app to read/write to the Yammer platform

    user_impersonation

     

    eG Enterprise provides a proprietary Powershell script, which will automatically register a Microsoft Graph app on Microsoft Azure Active Directory, and auto-configure the app with all the permissions required for monitoring.

    To know how to use this script, refer to theAutomatically Fulfilling Pre-requisites in a Basic Authentication-Enabled Environment topic.

    On the other hand, if you choose not to use the script, then you have to manually fulfill each of the requirements described above. To know how, refer to theRegistering the Microsoft Graph App On Microsoft Azure Active Directorytopic.

    Note:

    Typically, tests that use Microsoft Graph API may not start reporting metrics right away. Sometimes, they may go without reporting metrics for over 48 hours. This is normal behavior, and it occurs because, Microsoft does not collect/refresh the metrics as frequently as the tests execute.

  4. In addition to the above, the tests that use the Microsoft Graph API will run and report metrics, only if the following files are available on the eG agent host:

    • Microsoft.IdentityModel.Clients.ActiveDirectory.dll

    • Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll

    • Microsoft.IdentityModel.Clients.ActiveDirectory.Platform

    • Microsoft.IdentityModel.Clients.ActiveDirectory

    To make these files available to the eG agent, do the following:

    1. Login to the eG agent host.

    2. Open a browser and then access the following Sharefile site: https://www.eginnovations.com/releases/v7210/

    3. Open the Supporting Files folder therein, and then open the Azure AD for O365 sub-folder within. Figure 1 will then appear listing the files that the eG agent requires for running the tests that use the Microsoft Graph API.

      Supporting Files for Office 365 monitoring

      Figure 1 : Supporting Files for Office 365 monitoring

    4. Download all the files displayed in Figure 1 to any location on the eG agent host.

    5. Then, copy the downloaded files to the C:\Program Files\WindowsPowerShell\Modules\AzureAD\2.0.2.182\ folder on the eG agent host.

    6. Once the files are successfully copied, check if they are blocked. If so, unblock them. To unblock, follow the steps below:

      • Open Windows Explorer and navigate to the C:\Program Files\WindowsPowerShell\Modules\AzureAD\2.0.2.182\ folder.

      • Right-click on any of the files in that folder, and select the Properties option from the shortcut menu that pops up.

      • Figure 2 will then appear.

        Unblocking File

        Figure 2 : Unblocking a file

      • To unblock the chosen file, select the Unblock check box in the Security section of Figure 2.

      • Finally, click the OK button in Figure 2 to save the changes.

      • Repeat steps 2-5 for each of the files in that folder.

  5. The Office 365 monitoring account should not be 2FA/ MFA enabled. This is because, the eG agent does not support 2FA/MFA presently.