INSENTRA ENHANCED SUPPORT OFFICE 365 USER AUDIT REPORT. For CUSTOMER ABC. 10/02/2017 v1.0

Transcription

1 INSENTRA ENHANCED SUPPORT OFFICE 365 USER AUDIT REPORT For CUSTOMER ABC 10/02/2017 v1.0

2 ABC O365 User Audit Report 2 DOCUMENT INFORMATION CLIENT PROJECT TITLE DOCUMENT TYPE Company ABC O365 User Audit Report Insights & Analytics CREATION DATE 12/04/2017 RELEASE DATE 12/04/2017 AUTHOR AUTHOR TITLE John Gallacher Consultant PHONE NUMBER (02) ADDRESS REVIEWER John.gallacher@insentra.co.uk ESS / Cloud & Collab Teams VERSION 1.0 CONTACTS INSENTRA INSENTRA COMPANY ABC Gary Cohen Practice Manager, Enhanced Support m e gary.cohen@insentra.com.au Itzik Gur Director, Technology m e itzik.gur@insentra.com.au John Smith IT Employee Services Manager m e john.smith@companyabc.com VERSION HISTORY VER. DATE AUTHOR SUMMARY OF CHANGES /04/2017 John Gallacher Initial draft

3 ABC O365 User Audit Report 3 TABLE OF CONTENTS 1 Executive Summary User Audit & Insights (John Smith)... 5 General Information User Details User Licenses Mailbox Permissions Sent & Received Mail Mailbox Size & Growth... 9 Audit Information Audit Timeline Last Password Change File & Folder Operations Sharing & Access Requests SharePoint / OneDrive Sync Operations Top Operations by Service Azure AD Anomalous Activity... 14

4 ABC O365 User Audit Report 4 1 EXECUTIVE SUMMARY Following the recent O365 Health and Insights report which covered all users and services, Company ABC requested an additional ad-hoc report for John Smith (CIO). The audit information contained in this report was collected over the last 7 days (6 th of April 12 th of April). Additional information for Exchange Online was tracked over the last 30 days. The user operations for John totaled 104, the most recent 20 are included in section The remaining 84 can be found on the accompanying spreadsheet. There were no Exchange Online user activities logged for John, this feature is disabled by default. Section provides further information on this along with details on how to enable if Company ABC requires this visibility. There were no serious issues identified for John however his password is set to never expire and there are three staff members with access to his mailbox.

5 ABC O365 User Audit Report 5 2 USER AUDIT & INSIGHTS (JOHN SMITH) GENERAL INFORMATION The following sections provide valuable insights for status for the user object, licencing and Exchange Online statistics User Details ACTION: Review and confirm if user password should be set to Never Expire as this poses a security risk.

6 ABC O365 User Audit Report User Licenses ACTION: Intune and Deskless licenses are pending activation and provisioning. If these are not required consider disabling the applications and removing the licenses.

7 ABC O365 User Audit Report Mailbox Permissions ACTION: Review and confirm the 3 users listed should have access to John s mailbox.

8 ABC O365 User Audit Report Sent & Received Mail The following graph shows the total sent and received mail for John Smith over the last 30 days. On average there are approximately 60 inbound and 20 outbound s on working days. No issues or causes for concern were detected.

9 ABC O365 User Audit Report Mailbox Size & Growth Both the primary and archive mailboxes are well within limits with no cause for concern in relation to the size and growth over the last 30 days.

10 ABC O365 User Audit Report 10 AUDIT INFORMATION There were a total of 104 operations for John Smith in the last 7 days. Section details the 20 most recent. Please review the accompanying spreadsheet which contains all operations. Nothing anomalous was identified Audit Timeline Events / activities per day: Events / activities by location. All operations in the last 7 days were contained within Sydney.

11 ABC O365 User Audit Report 11 Audit List of all activities in the last 7 days. NOTE: Please review accompanying spreadsheet for all 104 operation in the last 7 days.

12 ABC O365 User Audit Report Last Password Change ACTION: Consider enabling regular password expiration policy File & Folder Operations The following tables show the files John has worked on in the recent 7 days.

13 ABC O365 User Audit Report Sharing & Access Requests There has been no sharing or access requests logged by John Smith in the last 30 days SharePoint / OneDrive Sync Operations The following table shows all SharePoint and OneDrive synchronizations initiated by John Smith over the last 7 days.

14 ABC O365 User Audit Report Top Operations by Service The following table shows the top operations by O365 service for John Smith. Note, there has been no activities logged for Exchange online. O365 mailbox auditing is disabled by default. ACTION: Review the mailbox audit configuration and enable via Powershell if this is a business requirement. The following Technet article details the steps: Azure AD Anomalous Activity There has been no anomalous sign in activity detected for John Smith in the following areas: Sign-ins after multiple failures Irregular sign-in activity Sign-ins from infected devices Sign-ins from unknown sources