Skip to main content

CollectorsCloud Collectors Administration Guide

Migrate to the Microsoft 365 Management Activity Cloud Collector

The Microsoft 365 Management Activity Cloud Collector enables you to ingest logs into the Exabeam Security Operations Platform and use the Search service to find specific events in those logs.

If you previously used the Office 365 Cloud Connector that was part of the SaaS Cloud Connectors, migration to the Cloud Collectors service is recommended. Before you migrate, consider the following:

  • License Requirements: No additional license is required. The Cloud Collectors app is included with your existing license.

  • SaaS Cloud Connectors Support: Both the SaaS Cloud Connectors and the new Cloud Collectors environments can run in parallel.

The following table displays the endpoints of the Office 365 SaaS Cloud Connector that are now mapped to the new Microsoft 365 Management Activity Cloud Collector.

Legacy Endpoint

New Data Source

management-active-directory

Active Directory

management-general

General

management-sharepoint

Sharepoint

management-exchange

Exchange

management-dlp

DLP

To migrate to the Microsoft 365 Management Activity Cloud Collector, use the following steps:

  1. Log in to the Exabeam Security Operations Platform with your registered credentials as an administrator.

  2. Navigate to Collectors > SaaS Cloud Connectors.

    Migrate_to_Crowdstrike_CC.png

    Note

    • To use the Migrate functionality, ensure that you have Exabeam Cloud Connectors version 2.5.483 or a later version.

    • Before migrating to the new cloud collector, ensure that you have set all the required permissions listed in the prerequisites.

  3. On the SaaS Cloud Connectors platform, navigate to Settings > Accounts.

  4. Click Migrate for the Office 365 account that you want to migrate to the Cloud Collectors service.

    offive_365_migration_1.png
  5. Click Migrate for the endpoints: graph, exchange-admin-reports, and management.

    offive_365_migration_2.png

    After you click Migrate, a cloud connector is migrated to Cloud Collectors on  Exabeam Security Operations Platform .

  6. To view the migrated connector, click View Migrated Collector.

    The following migrated Cloud Collectors are ready to ingest data.

  7. Verify if the migrated Cloud Collector instance is running smoothly by checking the status of the cloud collector.

    • If you see any errors, refer to the Error Messages section for resolution or contact Exabeam support. If errors persist and you want to use the old SaaS cloud connector, delete the newly migrated Cloud Collector instance on the Exabeam Security Operations Platform and continue to use the SaaS cloud connector.

    • After successful migration, if the newly migrated Cloud Collector runs smoothly, consider deleting the old Cloud Connector on the SaaS Cloud Connectors platform to avoid event duplication.