Office 365 discovery

• Introduction
• Pre rrequisites
• Parameters
• Manual execution
• Discovery
• Agents and modules generated by the plugin

Introduction

This plugin is intended to monitor the status of Microsoft 365 services and licenses, including active incidents, system messages and subscription details.

The plugin connects to the Microsoft Graph API to obtain information about the health of services, maintenance messages and licensing data, generating monitoring modules compatible with Pandora FMS.

Pre rrequisites

• • The plugin is a compilation that contains all the dependencies necessary for its use, so it only requires having an application in Microsoft Entra ID configured with the necessary permissions to be able to authenticate through a clientID, tenandID, and a secret. The process of creating and granting permissions is explained below:
    
    

    Registering an application in Microsoft Sign-in ID
    
    

    Office 365 management APIs require authentication using Microsoft Entra ID, which ensures secure access to tenant data. To use these APIs, you must first register the application within Microsoft Entra ID and define the permissions that the application will need to interact with Office 365 resources.

    
    

    Before you begin, ensure you have an Office 365 subscription and an Azure subscription linked together within the same tenant.

      
    
    

    Registering the application in the Azure portal

    Once you have configured the environment, you can proceed to register the application from the Azure portal by following these steps:

    
    

    1. Access the Azure portal (https://portal.azure.com) by signing in with a Microsoft tenant account that has the Office 365 subscription you are going to use.  You can also open the portal from the Microsoft 365 Admin Center, where there is usually a shortcut to the Azure dashboard.
    
    

    2. In the left side menu of the portal, select Microsoft Sign-in ID.

    
    

    

    
    

    3. On the Microsoft Entra ID page, go to the Application registrations section and click New registration.
    
    

    
    
    

    4. The wizard for creating a new application record will open. Complete the following fields:
    
    

    

    
       - Name: assign a descriptive name to your application.  
       - Access type: indicate who will be able to use the application (only accounts in your organization or also other tenants).  
       - Redirect URI: specify a URL to which the user will be redirected once authentication is complete (optional depending on the type of application).
    
    

    5. Finally, click Register to complete the process.
    
    

    Configure application properties in Microsoft Entra ID
    
    

    Once the application is registered, you need to define some key properties that determine how it will behave within Microsoft Entra ID and how tenant administrators will be able to grant the necessary permissions for the application to access data through the Office 365 management APIs.

     

    Key properties to review:

     

    - Client ID: This value is automatically generated in Microsoft Entra ID. The application will use it when requesting consent from tenant administrators and when requesting “application-only” access tokens.

     

    - Multitenant application: This option must be set to “Yes” to allow administrators from other tenants to grant access to your application through the Office 365 administration APIs. If left set to “No,” the application will only be able to work with data from the tenant in which it was registered.

     

    - Reply URL: This is the address to which a tenant administrator will be redirected after granting consent. You can define multiple reply URLs if needed. By default, Azure uses the same sign-in URL that was specified when creating the application, although this value can be changed at any time.

     

    Remember to save your changes once you have adjusted any of these properties

    
    
    

    Generate a new key for the application
    
    

    Follow these steps to create a new client secret:

     

    1. In the Azure portal, go to the Microsoft Sign-in ID section.  Within it, select Application registrations and then choose the application you previously registered.

    
    

    

    
    
    

    2. Once on the application page, click Certificates and Secrets in the left side menu. From there, you can upload certificates or create new client secrets. 
    
    

    

    
    
    

    3. On the Certificates and Secrets tab, select the New Client Secret option.  Enter a description to easily identify it, define its validity period, and then click Add.
    
    

    

    
    
    

    4. Once the secret has been created, its value will appear in the Client Secrets section. Copy this value using the clipboard icon and store it in a safe place.
    
    

    

    
    
    

    Azure only displays the client secret value when you initially generate it. You cannot return to this page and retrieve the client secret value later. Be sure to copy it and save it in a secure location so you can use it later.

  
  Apart from the secret, we will need the tenant ID and client ID for authentication. These can be obtained from the application's general menu:
  
  
  

  

  
  Define the permissions your application needs to access the Office 365 administration APIs.
  
  

  The last step is to specify exactly what permissions your application will require to use the Office 365 administration APIs. To do this, you must add access to these APIs and then set the necessary permissions.

   

  1. In the Azure portal, go to Microsoft Sign-in > Application registrations > All applications.  
     Select the relevant application and, in the left side menu, click API permissions.  
     Then click Add a permission to open the window where permissions are configured

  
  
  

  
  

  2. On the Microsoft API tab, select the Office 365 Admin API option.
  
  

  
  

  3. A side panel will appear where you can choose the types of permissions your app needs.  
     Once selected, click Add Permissions to confirm them.
  
  

  
  

  The permissions required by the plugin are as follows:
  
  

  

  Finally, select “Grant administrator consent for <tenant name>” to approve the permissions you have assigned to the application.
  
  

  

Parameters

agents_group_name= Group for created agents
interval= Agent creation interval
transfer_mode= transfer mode (local or tentacle)
client_id= Client ID of office account
tenant_id= Tenant ID of office account 
secret= Secret of office account
tentacle_ip= Tentacle address
tentacle_port= Tentacle port
logs = Activate with 1 for log module creation
utf8= Activate with 1, to encode the value of the module issues
no_data= If set to 1, only log modules will be created
prefix_licensing= Prefix for the license agent and its modules.
prefix = Prefix for the general agent and its modules
agent_name= Name for the general agent
agent_name_licensing= Name for the licensing agent
licensing= Activate with 1 to enable the creation of an agent for licensing and its modules.

agents_group_name = applications
interval = 300
transfer_mode = tentacle
secret = kxT8Q~wM87V2E~S3FAHF4FF4FovBMQzSAFA4Uqc.I
client_id = 4355g5g5fb-7cac-450a-8ba9-ef3edhadna3  
tenant_id = 540v7f7sv8s-345d-43ec-b511-d1cfdbdvbf43e4
tentacle_ip = 172.42.42.101
tentacle_port = 41121
logs = 1
utf8 = 1 
no_data = 1
prefix_licensing = REQ
prefix = REQ
agent_name = Office_status
agent_name_licensing = Office_licensing
licensing = 1

Manual execution

The format of the plugin execution is as follows:

./pandora_o365 --conf < path to the configuration file >

Por ejemplo:

./pandora_o365 --conf /usr/share/pandora_server/util/plugin/office365.conf

The execution will return an output in JSON format with information about the execution, and will generate an XML file for each monitored agent that will be sent to the Pandora FMS server by the transfer method indicated in the configuration.

Discovery

This plugin can be integrated with Pandora FMS Discovery.

To do so, you must load the “.disco” package that you can download from the Pandora FMS library:

https://marketplace.pandorafms.com/

Once loaded, Office 365 accounts can be monitored by creating Discovery tasks from the Management > Discovery > App section.

The following minimum data will be requested for each task:

• Client ID: Client id of the office 365 account
• Tenant ID: Tenant id of the office 365 account
• Secret: Secret of the office 365 account
• Tentacle IP: Tentacle address
• Tentacle port: Tentacle port

On the next page we will be asked for the following :

• Max Threads: Number of threads
• Agent Name: Name for the main agent
• Prefix: Prefix for the main agent and its modules
• Logs: Activate to enable the creation of log modules
• Utf8: Activate to enable the codification of Issue modules
• Not data: Activate to disable the monitoring of the general agent modules (except log modules)
• Activate licensing monitoring:  Activate to enable the monitoring of the licensing modules  
• Licensing agent name: Name of the licensing agent
• Prefix for licensing data:  Prefix for the licensing agent and its modules

Successfully completed tasks will have an execution summary with the following information:

• Total agents : Total number of agents generated by the task
• Total modules: Total number of modules generated by the task

Agents and modules generated by the plugin

The plugin will create an agent with the name that we configure with the name that we use with the parameter “agent_name”, it will have a status module and another one of active issues for each service. By default: “Pandora_O365_” .

Example:

O365_Bookings_active_issues

O365_Bookings_status

O365_cloudappsecurity_active_issues

O365_cloudappsecurity_status

O365_DynamicsAX_active_issues

O365_DynamicsAX_status

O365_DynamicsCRM_active_issues

O365_DynamicsCRM_status

O365_Exchange_active_issues

O365_Exchange_status

O365_Forms_active_issues

O365_Forms_status

O365_Intune_active_issues

O365_Intune_status

O365_kaizalamessagingservices_active_issues

O365_kaizalamessagingservices_status

O365_Lync_active_issues

O365_Lync_status

O365_MicrosoftFlowM365_active_issues

O365_MicrosoftFlowM365_status

O365_MicrosoftFlow_active_issues

O365_MicrosoftFlow_status

O365_microsoftteams_active_issues

O365_microsoftteams_status

O365_MobileDeviceManagement_active_issues

O365_MobileDeviceManagement_status

O365_O365Client_active_issues

O365_O365Client_status

O365_officeonline_active_issues

O365_officeonline_status

O365_OneDriveForBusiness_active_issues

O365_OneDriveForBusiness_status

O365_OrgLiveID_active_issues

O365_OrgLiveID_status

O365_OSDPPlatform_active_issues

O365_OSDPPlatform_status

O365_Planner_active_issues

O365_Planner_status

O365_PowerAppsM365_active_issues

O365_PowerAppsM365_status

O365_PowerApps_active_issues

O365_PowerApps_status

O365_ProjectForTheWeb_active_issues

O365_ProjectForTheWeb_status

O365_ProjectOnline_active_issues

O365_ProjectOnline_status

O365_RMS_active_issues

O365_RMS_status

O365_SharePoint_active_issues

O365_SharePoint_status

O365_StaffHub_active_issues

O365_StaffHub_status

O365_Stream_active_issues

O365_Stream_status

O365_SwayEnterprise_active_issues

O365_SwayEnterprise_status

O365_Viva_active_issues

O365_Viva_status

O365_yammer_active_issues

O365_yammer_status

The plugin will create an agent with the name that we configure with the name that we use with the parameter “agent_name_licensing”. By default : “Pandora_O365_licensing” . It will have the following modules:

<skuPartNumber>

<skuPartNumber> consumedUnits

<skuPartNumber> Units enabled

<skuPartNumber> Units lockedOut

<skuPartNumber> Units suspended

<skuPartNumber> Units warning

<skuPartNumber> Consumed Units %

<skuPartNumber> Units Available