How to Send Logs from Office 365 Cloud App Security: Step‑by‑Step Guide

What is Office 365 Cloud App Security and Why Log Export Matters

Office 365 Cloud App Security (Microsoft Defender for Cloud Apps) is Microsoft's Cloud Access Security Broker (CASB) that monitors user activity, detects risky behavior, and enforces policies across SaaS apps. Exporting its logs gives security teams visibility in SIEMs, Azure Sentinel, or other analytics platforms, enabling correlation with network events, alert automation, and compliance reporting.

Supported Log Types and Export Destinations

Cloud App Security can send three primary log categories:

• Activity logs – user sign‑ins, file actions, and app usage.
• Alert logs – policy‑triggered detections such as impossible travel or data exfiltration.
• Discovery logs – inventory of cloud apps discovered via traffic analysis.

Export destinations include:

• Azure Sentinel (native integration).
• Microsoft Sentinel via Log Analytics workspace.
• Third‑party SIEMs (Splunk, QRadar, ArcSight) using Syslog or HTTP POST.
• Azure Event Hubs for custom pipelines.

Prerequisites Before Enabling Log Export

Ensure the following are in place:

• A Cloud App Security tenant with Global admin or Security admin role.
• Appropriate licensing – Microsoft Defender for Cloud Apps (formerly Office 365 Cloud App Security) is required.
• Destination endpoint ready (e.g., Log Analytics workspace ID & key, Syslog server IP/port, or Event Hub namespace).
• Network connectivity from Microsoft's data centers to the endpoint (firewall rules, allowed ports).

Step‑by‑Step: Configuring Log Export to Azure Sentinel

1. Connect Cloud App Security to your Log Analytics workspace

In the Cloud App Security portal, navigate to Settings → Data Sources → Log Analytics. Click Add workspace and provide:

• Workspace ID
• Primary or secondary key
• Region (must match the workspace's region)

Save the connection; the portal validates the credentials.

2. Enable activity and alert streaming

After the workspace is linked, toggle the switches for Activity logs and Alert logs. Choose the desired retention (default 30 days) and click Save. Logs will now appear in the Office365_CloudAppSecurity table in Sentinel.

3. Verify ingestion

In Azure Sentinel, run a quick Kusto query:

Office365_CloudAppSecurity | take 10

If rows return, the pipeline is active.

Exporting Logs to a Third‑Party SIEM via Syslog

1. Create a Syslog collector endpoint

Set up a Linux or Windows server to listen on UDP/TCP port 514 (or a custom port). Ensure the server's firewall permits inbound traffic from Microsoft's IP ranges (see Microsoft's published Azure IP list).

2. Configure Syslog forwarding in Cloud App Security

In the portal go to Settings → Data Sources → Syslog and click Add Syslog server. Provide:

• Server IP or hostname
• Port number
• Protocol (UDP recommended for simplicity, TCP for reliability)
• Log format – choose CEF (Common Event Format) for broad compatibility.

Enable the toggle for the log categories you need (activity, alerts, discovery) and save.

3. Test the flow

Generate a test alert in Cloud App Security (e.g., create a custom policy that triggers on a dummy file download). Verify that a CEF‑formatted message appears in the Syslog collector's log file.

Understanding Log Formats and Mapping

Both Azure Sentinel and Syslog exports use standardized schemas that simplify downstream parsing:

When ingesting into a SIEM, map these fields to your standard event schema (e.g., src_user, dest_object, alert_severity) to enable consistent alert rules.

Common Troubleshooting Scenarios

• No logs appear in Sentinel. Verify the workspace ID/key, check the Azure activity log for "DataConnector" errors, and confirm that the tenant's "Log Analytics" connector is not disabled.
• Syslog messages are empty or malformed. Ensure CEF version is set to 0.1, confirm that required fields (deviceVendor, deviceProduct) are populated, and review the collector's parsing rules.
• High latency (>5 min) between event and ingestion. This usually indicates network throttling or Azure Event Hub back‑pressure; consider increasing the Event Hub partition count or enabling "Premium" tier for faster throughput.

Best Practices for Ongoing Log Management

To keep your Cloud App Security logging reliable and cost‑effective:

• Rotate or archive logs older than 90 days in Azure Storage to avoid Sentinel storage bloat.
• Implement a "log health" dashboard in Sentinel that alerts when the row count drops below a threshold.
• Use Microsoft's built‑in "Log Analytics workspace retention" settings to align with compliance requirements (e.g., 1 year for GDPR).
• Regularly review Microsoft's "Data residency" documentation to ensure logs are stored in the appropriate region.