Document toolboxDocument toolbox

Office 365 Exchange Message Tracing collector

Service description

Office 365 is a widely adopted productivity suite from Microsoft. The suite includes Microsoft Exchange Online, a collaboration service for email, calendars, contacts, and tasks. 

Message tracking, or message tracing, as it is called in Office 365, is one of the most basic tools used by administrators to monitor the email flow. As emails travel through Office 365, some information about them gets stored in logs and is available for administrative purposes. No matter if users delete or purge messages, the administrator is able to view basic information about sent and received emails.

Data source description

Data source

Message Reports

Description

Reports for every email sent and received through the Exchange Online organization

API endpoint

https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace

Collector service name

office365_exchange_message_service

Devo data table

cloud.office365.messagetracing

Vendor setup

In order to configure the integration between Devo and Office 365 Exchange Message Tracing, you need to create an Office 365 user that will be used to authenticate API requests.

The account must have administrative permissions in the Office 365 organization. If the account can view reports in the Office 365 control panel, then the account has permission to retrieve the data from the REST web service. This API requires the user to be assigned to the View-Only Recipients role. 

In the default Office 365 permissions structure, users with the following administrator permissions can access this report: billing administrator, global administrator, password administrator, service administrator, and user management administrator.

Learn more about this in the product documentation.

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

API limitations

The following are some API limitations that you must consider:

Resource URI

GET

POST

PUT

DELETE

Resource URI

GET

POST

PUT

DELETE

/auditlogEntryReport

2/sec and 1000/hr

10/min and 40/hour

-

2/sec and 1000/hr

/auditlogEntryReport/download

2/sec and 1000/hr

-

-

-