On Demand Audit

Streamline security, compliance & change auditing for hybrid Microsoft environments. As you move more workloads to the Microsoft cloud, your reliance on Azure AD will increase, and so will the risk and complexity in securing your hybrid environment. Unfortunately, the Office 365 and Azure AD security logs do not provide consolidated views of on-premises and cloud activity, and system-provided tools do not make it easy to identify exploits, vulnerabilities, and suspicious activity. Quest^®On Demand Audit tracks all configuration, user and administrator changes made across AD, Azure AD, file servers, network-attached storage, Exchange Online, SharePoint Online, OneDrive for Business and Teams. On Demand Audit proactively highlights security vulnerabilities and anomalous activity, and accelerates incident investigations through responsive search and contextual, interactive data visualizations.

Quickly investigate incidents and secure your hybrid environment in a single hosted dashboard with our Office 365 auditing tool - On Demand Audit.

Try Online Request Pricing

Nav Menu

Try Online

07:25

On Demand Audit is an Azure-hosted SaaS solution that provides visibility and insight into all configuration, user and administrator changes made across AD, Azure AD, file servers, network-attached storage, Exchange Online, SharePoint Online, OneDrive for Business and Teams. On Demand Audit combines on-premises threat prevention provided by Change Auditor with dynamic vulnerability assessment, automatic anomaly detection and contextual visualizations to mitigate costly attacks and speed security investigations.

What you get

Security dashboard

Critical asset protection

Integrated anomaly detection

Remediate AD attack paths

Hybrid auditing

Flexible search

Alerts

Security vulnerability dashboard

Analyze event data from on-prem and Office 365 workloads for a single view of security vulnerabilities and anomalous activity across your hybrid environment. Be alerted to indicators of compromise (IOCs), including Kerberos exploits, offline extraction of the AD database, unauthorized domain replication, changes to sensitive groups and roles, as well as unusual spikes in sign-in failures, account lockouts and activity by external guest users. Accelerate investigations through contextual visualizations to detect and stop breaches before they wreak havoc in your network.

Critical asset protection

Through integration with SpecterOps BloodHound Enterprise, identify all critical Tier Zero assets and automatically monitor them for any suspicious activity indicating they’ve been compromised.

Integrated anomaly detection

Automatically analyze all activity from your on-prem AD, file servers and network-attached storage, as well as Azure AD and Office 365 workloads to detect anomalous surges in sensitive activity that could be indicative of attack or compromise. Be proactively notified of suspicious increases in sign-in failures, account lockouts, permission changes, file renames, external guest activity, files shared externally, and more. Visualize anomalies in context to highlight true threats and accelerate response.

Remediate AD attack paths

Identify all attack paths to your critical Tier Zero assets by integrating with SpecterOps BloodHound Enterprise. Leverage On Demand Audit’s detailed user activity history to inspect attack path edges prior to removing access to the path – ensuring there are no unexpected consequences to the remediation.

Hybrid identity auditing

Search by both on premises and cloud identities, so you can find all user activity regardless of where the activity originated, leading to more thorough Office 365 auditing. Through integration with Quest Change Auditor, on-premises AD activity is combined with cloud activity for a hybrid view of all user actions.

Responsive, flexible search

Slash investigation time with fast, intuitively built searches across tenants that deliver immediate results. On Demand Audit simplifies your Office 365 security audit by providing flexible searches on any event or any field, including by actor, changed attributes, activity details or cloud-only objects.

Real-time email alerts with On Demand Audit

04:23

Real-time alerts on the move

Maintain constant visibility and respond from anywhere — and on any device —to vital policy changes and suspicious events, regardless whether they occur on premises or in the cloud. With On Demand Audit, you can send real-time alerts of an Office 365 security audit to email and mobile devices to prompt immediate action, even while you're not on site.

That’s not all!

Interactive data visualizations

Transform millions of on-premises and Office 365 audit events into interactive visual dashboards that help you simplify compliance reporting and investigate incidents faster.

Threat prevention

Integrate with Change Auditor to block attackers from lateral movement by stopping them from making changes to on-premises groups and GPOs or exfiltrating your AD database to steal credentials – regardless of the privileges they’ve hijacked.

360° security protection

From upfront vulnerability assessment to intrusion detection and monitoring of compromised accounts, Change Auditor has you covered at every step.

Normalized audit view

Unlike Office 365 auditing using Microsoft-provided tools, On Demand Audit translates raw audit logs into a meaningful, normalized format. On Demand highlights the most important event details, including before and after values, so you can make quick decisions where your security is concerned.

Long-term storage

On Demand Audit stores audit history for up to 10 years at a fixed subscription price. This enables you to keep the audit data you need to satisfy security and compliance policies, without increasing your own Azure storage costs.

Granular, delegated access

In just a few clicks with On Demand Audit, you can give your security and compliance teams, help desk staff, IT managers and even external auditors and partners exactly the reports they need and nothing more. On Demand Audit provides granular, delegated access to safely empower users to get the insights they need without making any configuration changes and or setting up additional infrastructure.

On-prem, cloud or hybrid? Quest has you covered!

For truly comprehensive Office 365 auditing, upgrade to the On Demand Audit Hybrid Suite for Office 365, which includes On Demand Audit, Change Auditor for Active Directory and Change Auditor for Logon Activity. On Demand Audit consolidates and correlates Change Auditor’s in-depth, high-fidelity on-prem audit data together with cloud activity from Azure AD and Office 365 workloads to get a single, hosted view of all changes across your hybrid environment.

Learn More

Screenshot Tour

Security vulnerability dashboard

Critical asset protection

Automated anomaly detection

Interactive visualizations

Normalized audit view

Active Directory auditing

On-premises logon activity

On-premises file auditing

Azure AD auditing

Azure AD sign-ins

Teams auditing

Exchange Online auditing