Forum Discussion

Brogie's avatar
Brogie
Brass Contributor
Jan 20, 2021

Auditing when an exclusion is added or removed from Azure ATP

Trying to ascertain where the configuration in Azure ATP is stored that changes in exclusions can be logged for alerting and or review?

  • EliOfek's avatar
    EliOfek
    Icon for Microsoft rankMicrosoft
    Jan 20, 2021

    Brogie 
    Currently it is audited in the backend and not customer visible directly.

    In case of need , open a support case with the specific data you are interested in from the audit logs, 
    And the data will be pulled  for you from the backend.

    I am aware that this is planned to be changed at some point and this data is planned to be customer visible, but can't tell you when and how exactly...

    • Brogie's avatar
      Brogie
      Brass Contributor
      Jan 21, 2021

      EliOfek  Thanks, is there a capability to export the config to JSON similar to ATA which then I could do compares of the configs at different points in time?

      • EliOfek's avatar
        EliOfek
        Icon for Microsoft rankMicrosoft
        Jan 21, 2021

        Brogie  Officially no, But unofficially , F12 dev tools might work for what you want, although far from optimal.

    • Przem0's avatar
      Przem0
      Brass Contributor
      Jun 29, 2022

      Hi EliOfek,

      It's quite old issue with auditing but is it already available for customers?

      • EliOfek's avatar
        EliOfek
        Icon for Microsoft rankMicrosoft
        Jun 29, 2022
        No, there are concrete plans to add it to the new portal (security.microsoft.com) to M365 Auditing,
        But no ETA that I can share yet, sorry.

Resources