Trouble getting 0365 logs into CAS

Highlighted
Occasional Contributor

I went through the setup post but I seem to be missing the powerbi part i think. 

 

I am not sure what i am missing the document seems to leave some stuff out. 

 

How exactly do I enable the powerbi auditing? Also any other help would be amazing. 

 

https://docs.microsoft.com/en-us/cloud-app-security/connect-office-365-to-microsoft-cloud-app-securi...

 

https://docs.microsoft.com/en-us/power-bi/service-admin-auditing

10 Replies
Highlighted

Well, do you actually get PowerBI audit events at all, can you search for those in the SCC? If you are using the "general" O365 service, PowerBI auditing should be enabled by default, you cannot even modify those settings (found under PowerBI -> Admin portal -> Tenant settings -> Audit and usage settings).

 

As long as those are enabled, there shouldn't be anything else to configure. But availability might depend on the type of O365 tenant you have. On my "general" O365 one, I see the PowerBI events in both the SCC and CAS just fine, never configured anything there.

Highlighted

This is in an E3 license tenant. 

 

That is how I thought this worked, but i do not see any powerbi audit logs when i search. I will look again real quick. 

Highlighted

I did just notice this tenant doesn't have Office 365 Analytics subscription not sure if that is related. 

 

Nothing for powerbi logs. 

Highlighted

Also after you enabled CAS in the security portal did the dashboard start showing info after a couple days? 

Highlighted

It definitely takes some time for events to start popping up, so if you have just enabled it maybe wait a little.

Highlighted

No been about a week now. 

Highlighted

cas.PNG

 

This is still what I see on the discovery dashboard. 

Highlighted

Try using the direct URL, should be something like https://TENANTNAME.portal.cloudappsecurity.com/

 

If it still doesn't work, I guess it's time to open a support case.

Highlighted

Yeah that is the url of that pic. Well Support case here I come. 

 

Thanks for sticking around. 

Highlighted

Well for anyone else in this same boat message from MS. Licensing issue was my problem. 

 

 

There are 3 versions of Cloud App Security as follows:

 

Microsoft Cloud App Security

Office 365 Cloud App Security

Cloud App Discovery

 

The following documentation has the full details and provides a table that compares Cloud App Discovery features with Microsoft Cloud App Security.  Cloud App Discovery also comes with Azure Active Directory P1 Plan Besides EMS E3. 

 

Link:  https://docs.microsoft.com/en-us/cloud-app-security/editions-cloud-app-security-aad

 

You can also review the comparisons between Office 365 Cloud App Security and Microsoft Cloud App Security using this link to the documentation:

 

Link:  https://docs.microsoft.com/en-us/cloud-app-security/editions-cloud-app-security-o365