O365 Management logs user deleted discrepancy

%3CLINGO-SUB%20id%3D%22lingo-sub-2894153%22%20slang%3D%22en-US%22%3EO365%20Management%20logs%20user%20deleted%20discrepancy%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2894153%22%20slang%3D%22en-US%22%3E%3CP%3EDear%20Team%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20integrated%20O365%20Management%20logs%20with%20our%20SIEM%20tool.%20And%20we%20are%20observing%20logs%20for%20user%20deleted%2C%20added%20etc.%20but%20the%20problem%20is%20we%20are%20not%20getting%20the%20actual%20username%20in%20the%20logs.%20But%20we%20are%20getting%20some%20random%20numbers%20instead%20of%20correct%20usernames.%3C%2FP%3E%3CP%3Ee.g.%20is%20%3CRANDOM_NUMBERS%3E%40%3COURDOMAIN%3E.onmicrosoft.com%3C%2FOURDOMAIN%3E%3C%2FRANDOM_NUMBERS%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EKindly%20help%20why%20it%20is%20showing%20in%20this%20format%20also%20how%20can%20we%20get%20the%20exact%20user%20which%20got%20deleted.%3C%2FP%3E%3CP%3EPlease%20help%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3ESameer%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2894153%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Visitor

Dear Team,

 

We have integrated O365 Management logs with our SIEM tool. And we are observing logs for user deleted, added etc. but the problem is we are not getting the actual username in the logs. But we are getting some random numbers instead of correct usernames.

e.g. is <random_numbers>@<ourdomain>.onmicrosoft.com

 

Kindly help why it is showing in this format also how can we get the exact user which got deleted.

Please help

Regards,

Sameer

0 Replies