Repository: elastic/integrations
Pull request #13170: add new 'tenant_settings' data stream to o365_metrics integration
Author: login: tommyers-elastic
Labels: name: enhancement
description: New feature or request
name: Team:Obs-InfraObs
description: Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations]
name: Integration:o365_metrics
description: Microsoft Office 365 Metrics
Created: 2025-03-19T11:56:13Z | Merged: 2025-03-27T13:56:42Z

<!-- Type of change
Please label this PR with one of the following labels, depending on the scope of your change:
- Bug
- Enhancement
- Breaking change
- Deprecation
-->

add new 'tenant_settings' data stream to o365_metrics integration

## Checklist

- [x] I have reviewed [tips for building integrations](https://github.com/elastic/integrations/blob/main/docs/tips_for_building_integrations.md) and this pull request is aligned with them.
- [x] I have verified that all data streams collect metrics or logs.
- [x] I have added an entry to my package's `changelog.yml` file.
- [x] I have verified that Kibana version constraints are current according to [guidelines](https://github.com/elastic/elastic-package/blob/master/docs/howto/stack_version_support.md#when-to-update-the-condition).
- [x] I have verified that any added dashboard complies with Kibana's [Dashboard good practices](https://docs.elastic.dev/ux-guidelines/data-viz/dashboard-good-practices) 

## Author's Checklist

<!-- Recommended
Add a checklist of things that are required to be reviewed in order to have the PR approved
-->
- [ ] 

## How to test this PR locally

<!-- Recommended
Explain here how this PR will be tested by the reviewer: commands, dependencies, steps, etc.
-->

## Related issues

<!-- Recommended
Link related issues below. Insert the issue link or reference after the word "Closes" if merging this should automatically close it.

- Closes #123
- Relates #123
- Requires #123
- Supersedes #123
-->
- 

## Screenshots

<!-- Optional
Add here screenshots presenting:
- Kibana UI forms presenting configuration options exposed by the integration
- dashboards with collected metrics or logs
-->



Diff:
diff --git a/packages/o365_metrics/_dev/build/docs/README.md b/packages/o365_metrics/_dev/build/docs/README.md
index 640e9f014de..9614b7d2653 100644
--- a/packages/o365_metrics/_dev/build/docs/README.md
+++ b/packages/o365_metrics/_dev/build/docs/README.md
@@ -6,8 +6,8 @@ This integration uses the [Microsoft Graph API](https://learn.microsoft.com/en-u
 
 Following Microsoft 365 Graph Reports can be collected by Microsoft Office 365 Metrics integration.
 
-| Report          | API | Data-stream Name | Aggregation Level |
-|-----------------|-----|-------------|-------------------|
+| Report          | API | Data-stream Name | Aggregation Level | Required permissions
+|-----------------|-----|------------------|-------------------|--------------------|
 | [Microsoft 365 Active Users Service User Counts](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/active-users-ww?view=o365-worldwide)      |    [reportRoot: getOffice365ServicesUserCounts](https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365servicesusercounts?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Active Users metrics   |   `Period`-based   |
 | [Microsoft 365 Groups Activity Group Detail](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/office-365-groups-ww?view=o365-worldwide)      |    [reportRoot: getOffice365GroupsActivityDetail](https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365groupsactivitydetail?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Groups Activity Group Detail   |   `Day`-based   |
 | [OneDrive Usage Account Detail](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-worldwide)      |    [reportRoot: getOneDriveUsageAccountDetail](https://learn.microsoft.com/en-us/graph/api/reportroot-getonedriveusageaccountdetail?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 OneDrive Usage Account Detail   |   `Day`-based   |
@@ -28,6 +28,7 @@ Following Microsoft 365 Graph Reports can be collected by Microsoft Office 365 M
 | [Service Health](https://learn.microsoft.com/en-us/graph/service-communications-concept-overview?view=o365-worldwide)                                                 |    [reportRoot: getServiceHealth](https://learn.microsoft.com/en-us/graph/api/servicehealth-get?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Service Health metrics   |   No aggregation  |
 | [Subscriptions](https://learn.microsoft.com/en-us/graph/api/resources/subscribedsku?view=graph-rest-1.0?view=o365-worldwide)                                                 |    [reportRoot: subscribedSkus](https://learn.microsoft.com/en-us/graph/api/subscribedsku-list?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Subscriptions metrics   |   No aggregation  |
 | [Teamms Call Quality](https://learn.microsoft.com/en-us/graph/api/resources/communications-api-overview?view=graph-rest-1.0?view=o365-worldwide)                                                 |    [reportRoot: callRecords](https://learn.microsoft.com/en-us/graph/api/callrecords-callrecord-list-sessions?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Teams Call Quality metrics   |   No aggregation  |
+| Tenant Settings | [organization](https://learn.microsoft.com/en-us/graph/api/resources/organization?view=graph-rest-1.0), [adminReportSettings](https://learn.microsoft.com/en-us/graph/api/resources/adminreportsettings?view=graph-rest-1.0) | Microsoft 365 Tenant Settings | No aggregation | Organization.Read.All, ReportSettings.Read.All
 
 ## Setup
 
diff --git a/packages/o365_metrics/_dev/deploy/docker/docker-compose.yml b/packages/o365_metrics/_dev/deploy/docker/docker-compose.yml
index 06bf25bf94a..2ea544f27ee 100644
--- a/packages/o365_metrics/_dev/deploy/docker/docker-compose.yml
+++ b/packages/o365_metrics/_dev/deploy/docker/docker-compose.yml
@@ -12,4 +12,4 @@ services:
     command:
       - http-server
       - --addr=:8090
-      - --config=/files/config.yml
\ No newline at end of file
+      - --config=/files/config.yml
diff --git a/packages/o365_metrics/_dev/deploy/docker/files/config.yml b/packages/o365_metrics/_dev/deploy/docker/files/config.yml
index f5be19327a0..be2f9cef2ae 100644
--- a/packages/o365_metrics/_dev/deploy/docker/files/config.yml
+++ b/packages/o365_metrics/_dev/deploy/docker/files/config.yml
@@ -283,4 +283,44 @@ rules:
                       ]
                   }
               ]
+          }
+  - path: /admin/reportSettings
+    methods: ['GET']
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          { 
+              "value": {
+                  "@odata.type": "#microsoft.graph.adminReportSettings", 
+                  "displayConcealedNames": true 
+              }
+          }
+  - path: /organization
+    methods: ['GET']
+    query_params:
+      '$select': 'id,displayName,tenantType'
+    request_headers:
+      Authorization:
+        - "Bearer xxxx"
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {
+              "@odata.context": "https://graph.microsoft.com/v1.0/$metadata#organization(id,displayName,tenantType)",
+              "value": [
+                  {
+                      "id": "aa40685b-417d-4664-b4ec-8f7640719adb",
+                      "displayName": "azure2",
+                      "tenantType": "AAD"
+                  }
+              ]
           }
\ No newline at end of file
diff --git a/packages/o365_metrics/changelog.yml b/packages/o365_metrics/changelog.yml
index 51ac01cf70c..44a4fa0d96a 100644
--- a/packages/o365_metrics/changelog.yml
+++ b/packages/o365_metrics/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.7.0"
+  changes:
+    - description: Add 'tenant settings' data stream.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/13170
 - version: "0.6.6"
   changes:
     - description: Add support for configuring resource parameters, such as rate_limit, retry, and others.
diff --git a/packages/o365_metrics/data_stream/tenant_settings/_dev/test/system/test-default-config.yml b/packages/o365_metrics/data_stream/tenant_settings/_dev/test/system/test-default-config.yml
new file mode 100644
index 00000000000..bd09d14fdb2
--- /dev/null
+++ b/packages/o365_metrics/data_stream/tenant_settings/_dev/test/system/test-default-config.yml
@@ -0,0 +1,19 @@
+input: cel
+service: o365_metrics
+vars:
+  url: http://{{Hostname}}:{{Port}}
+  token_url: http://{{Hostname}}:{{Port}}
+  azure_tenant_id: "1234"
+  client_id: "1234"
+  client_secret: "1234"
+data_stream:
+  vars:
+    interval: 5s
+    preserve_original_event: true
+assert:
+  hit_count: 2
+  fields_present:
+    - o365.metrics.tenant_settings.display_concealed_names
+    - o365.metrics.tenant_settings.tenant.display_name
+    - o365.metrics.tenant_settings.tenant.id
+    - o365.metrics.tenant_settings.tenant.type
diff --git a/packages/o365_metrics/data_stream/tenant_settings/agent/stream/cel.yml.hbs b/packages/o365_metrics/data_stream/tenant_settings/agent/stream/cel.yml.hbs
new file mode 100644
index 00000000000..ef697d8d29e
--- /dev/null
+++ b/packages/o365_metrics/data_stream/tenant_settings/agent/stream/cel.yml.hbs
@@ -0,0 +1,138 @@
+interval: {{interval}}
+{{#if enable_request_tracer}}
+resource.tracer.filename: "../../logs/cel/http-request-trace-*.ndjson"
+resource.tracer.maxbackups: 5
+resource.tracer.maxsize: 5
+{{/if}}
+{{#if proxy_url}}
+resource.proxy_url: {{proxy_url}}
+{{/if}}
+{{#if resource_ssl}}
+resource.ssl: 
+  {{resource_ssl}}
+{{/if}}
+{{#if resource_timeout}}
+resource.timeout: {{resource_timeout}}
+{{/if}}
+{{#if resource_retry_max_attempts}}
+resource.retry.max_attempts: {{resource_retry_max_attempts}}
+{{/if}}
+{{#if resource_retry_wait_min}}
+resource.retry.wait_min: {{resource_retry_wait_min}}
+{{/if}}
+{{#if resource_retry_wait_max}}
+resource.retry.wait_max: {{resource_retry_wait_max}}
+{{/if}}
+{{#if resource_redirect_forward_headers}}
+resource.redirect.forward_headers: {{resource_redirect_forward_headers}}
+{{/if}}
+{{#if resource_redirect_headers_ban_list}}
+resource.redirect.headers_ban_list:
+{{#each resource_redirect_headers_ban_list as |item|}}
+  - {{item}}
+{{/each}}
+{{/if}}
+{{#if resource_redirect_max_redirects}}
+resource.redirect.max_redirects: {{resource_redirect_max_redirects}}
+{{/if}}
+{{#if resource_rate_limit_limit}}
+resource.rate_limit.limit: {{resource_rate_limit_limit}}
+{{/if}}
+{{#if resource_rate_limit_burst}}
+resource.rate_limit.burst: {{resource_rate_limit_burst}}
+{{/if}}
+resource.url: {{url}}
+auth.oauth2:
+  client.id: {{client_id}}
+  client.secret: {{client_secret}}
+  provider: azure
+  scopes:
+{{#each token_scopes as |token_scope|}}
+    - {{token_scope}}
+{{/each}}
+  endpoint_params: 
+    grant_type: client_credentials
+{{#if token_url}}
+  token_url: {{token_url}}/{{azure_tenant_id}}/oauth2/v2.0/token
+{{else if azure_tenant_id}}
+  azure.tenant_id: {{azure_tenant_id}}
+{{/if}}
+redact:
+  fields: ~
+state: 
+  admin_report_settings_path: '/admin/reportSettings'
+  orgs_path: '/organization?$select=id,displayName,tenantType'
+program: |
+    state.with(
+      request("GET", state.url.trim_right("/") + state.admin_report_settings_path).do_request().as(admin_report_settings_resp,
+        admin_report_settings_resp.StatusCode == 200
+        ?
+          bytes(admin_report_settings_resp.Body).decode_json().as(admin_report_settings_json, 
+            request("GET", state.url.trim_right("/") + state.orgs_path).do_request().as(orgs_resp, 
+              orgs_resp.StatusCode == 200
+              ?
+                bytes(orgs_resp.Body).decode_json().as(orgs_json,
+                  {
+                    "events": [{
+                      "o365": {
+                        "metrics": {
+                          "tenant_settings": {
+                            "display_concealed_names": admin_report_settings_json.value.displayConcealedNames,
+                            "tenant": {
+                              "display_name": orgs_json.value[0].displayName,
+                              "id": orgs_json.value[0].id,
+                              "type": orgs_json.value[0].tenantType
+                            }
+                          }
+                        }
+                      }
+                    }]
+                  }
+                )
+              :
+                {
+                  "events": {
+                    "error": {
+                      "code": string(orgs_resp.StatusCode),
+                      "id": string(orgs_resp.Status),
+                      "message": "GET " + state.orgs_path + ": " + (
+                        size(orgs_resp.Body) != 0 ?
+                          string(orgs_resp.Body)
+                        :
+                          string(orgs_resp.Status) + ' (' + string(orgs_resp.StatusCode) + ')'
+                      ),
+                    },
+                  },
+                  "want_more": false,
+                }
+            )
+          )
+        : 
+          {
+            "events": {
+              "error": {
+                "code": string(admin_report_settings_resp.StatusCode),
+                "id": string(admin_report_settings_resp.Status),
+                "message": "GET " + state.admin_report_settings_path + ": " + (
+                  size(admin_report_settings_resp.Body) != 0 ?
+                    string(admin_report_settings_resp.Body)
+                  :
+                    string(admin_report_settings_resp.Status) + ' (' + string(admin_report_settings_resp.StatusCode) + ')'
+                ),
+              },
+            },
+            "want_more": false,
+          }
+      )
+    )
+tags:
+{{#each tags as |tag|}}
+  - {{tag}}
+{{/each}}
+{{#contains "forwarded" tags}}
+publisher_pipeline.disable_host: true
+{{/contains}}
+{{#if processors}}
+processors:
+{{processors}}
+{{/if}}
diff --git a/packages/o365_metrics/data_stream/tenant_settings/elasticsearch/ingest_pipeline/default.yml b/packages/o365_metrics/data_stream/tenant_settings/elasticsearch/ingest_pipeline/default.yml
new file mode 100644
index 00000000000..b2aa9119730
--- /dev/null
+++ b/packages/o365_metrics/data_stream/tenant_settings/elasticsearch/ingest_pipeline/default.yml
@@ -0,0 +1,6 @@
+---
+description: Ingest pipeline for o365_metrics 'tenant_settings' data stream.
+processors:
+  - set:
+      field: ecs.version
+      value: "8.17.0"
\ No newline at end of file
diff --git a/packages/o365_metrics/data_stream/tenant_settings/fields/base-fields.yml b/packages/o365_metrics/data_stream/tenant_settings/fields/base-fields.yml
new file mode 100644
index 00000000000..5872551bc90
--- /dev/null
+++ b/packages/o365_metrics/data_stream/tenant_settings/fields/base-fields.yml
@@ -0,0 +1,15 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
+- name: '@timestamp'
+  type: date
+  description: Event timestamp.
+- name: input.type
+  type: keyword
+  description: Input type.
\ No newline at end of file
diff --git a/packages/o365_metrics/data_stream/tenant_settings/fields/fields.yml b/packages/o365_metrics/data_stream/tenant_settings/fields/fields.yml
new file mode 100644
index 00000000000..1f704d2fbe4
--- /dev/null
+++ b/packages/o365_metrics/data_stream/tenant_settings/fields/fields.yml
@@ -0,0 +1,25 @@
+- name: o365.metrics.tenant_settings
+  type: group
+  fields:
+    - name: display_concealed_names
+      type: boolean
+      description: |
+        If set to true, all reports conceal user information such as usernames, groups, and sites. If false, all reports show identifiable information. This property represents a setting in the Microsoft 365 admin center.
+    - name: tenant
+      type: group
+      fields: 
+        - name: display_name
+          type: keyword
+          description: |
+            The display name for the tenant.
+        - name: id
+          type: keyword
+          description: |
+            The tenant ID, a unique identifier representing the organization (or tenant).
+        - name: type
+          type: keyword
+          description: |
+            Can be one of the following types:
+             * AAD - An enterprise identity access management (IAM) service that serves business-to-employee and business-to-business (B2B) scenarios.
+             * AAD B2C An identity access management (IAM) service that serves business-to-consumer (B2C) scenarios.
+             * CIAM - A customer identity & access management (CIAM) solution that provides an integrated platform to serve consumers, partners, and citizen scenarios.
diff --git a/packages/o365_metrics/data_stream/tenant_settings/manifest.yml b/packages/o365_metrics/data_stream/tenant_settings/manifest.yml
new file mode 100644
index 00000000000..8bb084e3722
--- /dev/null
+++ b/packages/o365_metrics/data_stream/tenant_settings/manifest.yml
@@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
+      - name: interval
+        type: text
+        title: Interval
+        description: The interval at which the API is polled, supported in seconds, minutes, and hours.
+        show_user: true
+        required: true
+        default: 24h
+      - name: tags
+        type: text
+        title: Tags
+        multi: true
+        required: false
+        show_user: false
+        default:
+          - o365.metrics.tenant_settings
+      - name: enable_request_tracer
+        type: bool
+        title: Enable request tracing
+        multi: false
+        required: false
+        show_user: false
+        description: >-
+          The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.
+      - name: processors
+        type: yaml
+        title: Processors
+        multi: false
+        required: false
+        show_user: false
+        description: >
+          Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.
\ No newline at end of file
diff --git a/packages/o365_metrics/data_stream/tenant_settings/sample_event.json b/packages/o365_metrics/data_stream/tenant_settings/sample_event.json
new file mode 100644
index 00000000000..7f9d89a88ea
--- /dev/null
+++ b/packages/o365_metrics/data_stream/tenant_settings/sample_event.json
@@ -0,0 +1,68 @@
+{
+    "o365": {
+        "metrics": {
+            "tenant_settings": {
+                "display_concealed_names": true,
+                "tenant": {
+                    "id": "f99cbd5a-95d6-4767-9372-0d41ca2ead9d",
+                    "type": "AAD",
+                    "display_name": "azure2"
+                }
+            }
+        }
+    },
+    "input": {
+        "type": "cel"
+    },
+    "agent": {
+        "name": "elastic-agent-19515",
+        "id": "37f1ae71-1a03-4d62-82e0-59e440f35824",
+        "ephemeral_id": "b19c8d15-4089-4209-ad9e-fab4e4491827",
+        "type": "filebeat",
+        "version": "8.17.3"
+    },
+    "@timestamp": "2025-03-24T14:49:05.173Z",
+    "ecs": {
+        "version": "8.17.0"
+    },
+    "data_stream": {
+        "namespace": "62584",
+        "type": "metrics",
+        "dataset": "o365_metrics.tenant_settings"
+    },
+    "elastic_agent": {
+        "id": "37f1ae71-1a03-4d62-82e0-59e440f35824",
+        "version": "8.17.3",
+        "snapshot": false
+    },
+    "host": {
+        "hostname": "elastic-agent-19515",
+        "os": {
+            "kernel": "6.12.5-linuxkit",
+            "name": "Wolfi",
+            "family": "",
+            "type": "linux",
+            "version": "20230201",
+            "platform": "wolfi"
+        },
+        "containerized": false,
+        "ip": [
+            "172.20.0.2",
+            "172.18.0.5"
+        ],
+        "name": "elastic-agent-19515",
+        "mac": [
+            "02-42-AC-12-00-05",
+            "02-42-AC-14-00-02"
+        ],
+        "architecture": "aarch64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "ingested": "2025-03-24T14:49:06Z",
+        "dataset": "o365_metrics.tenant_settings"
+    },
+    "tags": [
+        "o365.metrics.tenant_settings"
+    ]
+}
\ No newline at end of file
diff --git a/packages/o365_metrics/docs/README.md b/packages/o365_metrics/docs/README.md
index 158028fa0be..4bb48b3a860 100644
--- a/packages/o365_metrics/docs/README.md
+++ b/packages/o365_metrics/docs/README.md
@@ -6,8 +6,8 @@ This integration uses the [Microsoft Graph API](https://learn.microsoft.com/en-u
 
 Following Microsoft 365 Graph Reports can be collected by Microsoft Office 365 Metrics integration.
 
-| Report          | API | Data-stream Name | Aggregation Level |
-|-----------------|-----|-------------|-------------------|
+| Report          | API | Data-stream Name | Aggregation Level | Required permissions
+|-----------------|-----|------------------|-------------------|--------------------|
 | [Microsoft 365 Active Users Service User Counts](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/active-users-ww?view=o365-worldwide)      |    [reportRoot: getOffice365ServicesUserCounts](https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365servicesusercounts?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Active Users metrics   |   `Period`-based   |
 | [Microsoft 365 Groups Activity Group Detail](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/office-365-groups-ww?view=o365-worldwide)      |    [reportRoot: getOffice365GroupsActivityDetail](https://learn.microsoft.com/en-us/graph/api/reportroot-getoffice365groupsactivitydetail?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Groups Activity Group Detail   |   `Day`-based   |
 | [OneDrive Usage Account Detail](https://learn.microsoft.com/en-us/microsoft-365/admin/activity-reports/onedrive-for-business-usage-ww?view=o365-worldwide)      |    [reportRoot: getOneDriveUsageAccountDetail](https://learn.microsoft.com/en-us/graph/api/reportroot-getonedriveusageaccountdetail?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 OneDrive Usage Account Detail   |   `Day`-based   |
@@ -28,6 +28,7 @@ Following Microsoft 365 Graph Reports can be collected by Microsoft Office 365 M
 | [Service Health](https://learn.microsoft.com/en-us/graph/service-communications-concept-overview?view=o365-worldwide)                                                 |    [reportRoot: getServiceHealth](https://learn.microsoft.com/en-us/graph/api/servicehealth-get?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Service Health metrics   |   No aggregation  |
 | [Subscriptions](https://learn.microsoft.com/en-us/graph/api/resources/subscribedsku?view=graph-rest-1.0?view=o365-worldwide)                                                 |    [reportRoot: subscribedSkus](https://learn.microsoft.com/en-us/graph/api/subscribedsku-list?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Subscriptions metrics   |   No aggregation  |
 | [Teamms Call Quality](https://learn.microsoft.com/en-us/graph/api/resources/communications-api-overview?view=graph-rest-1.0?view=o365-worldwide)                                                 |    [reportRoot: callRecords](https://learn.microsoft.com/en-us/graph/api/callrecords-callrecord-list-sessions?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Teams Call Quality metrics   |   No aggregation  |
+| Tenant Settings | [organization](https://learn.microsoft.com/en-us/graph/api/resources/organization?view=graph-rest-1.0), [adminReportSettings](https://learn.microsoft.com/en-us/graph/api/resources/adminreportsettings?view=graph-rest-1.0) | Microsoft 365 Tenant Settings | No aggregation | Organization.Read.All, ReportSettings.Read.All
 
 ## Setup
 
diff --git a/packages/o365_metrics/manifest.yml b/packages/o365_metrics/manifest.yml
index 9cbfa70dd83..49eaef03969 100644
--- a/packages/o365_metrics/manifest.yml
+++ b/packages/o365_metrics/manifest.yml
@@ -1,6 +1,6 @@
 name: o365_metrics
 title: Microsoft Office 365 Metrics
-version: "0.6.6"
+version: "0.7.0"
 description: Collect metrics from Microsoft Office 365 with Elastic Agent.(This integration is currently in development and not yet ready for general use)
 type: integration
 format_version: "3.0.2"


Reviews:
user: login: ritalwar
body: The changelog entry and sample_event.json are missing.
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T11:34:21Z
user: login: tommyers-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T11:53:38Z
user: login: tommyers-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T11:54:15Z
user: login: ritalwar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T03:18:52Z
user: login: tommyers-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T09:11:55Z
user: login: tommyers-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T09:17:28Z
user: login: ritalwar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T09:18:22Z
user: login: tommyers-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T09:20:23Z
user: login: ritalwar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T09:24:54Z
user: login: ritalwar
body: LGTM!
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T09:52:26Z
user: login: ritalwar
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T10:08:18Z
user: login: lucian-ioan
body: LGTM
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T12:07:44Z
user: login: tommyers-elastic
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-26T09:30:31Z

Review comments:
diff_hunk: @@ -0,0 +1,15 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
+- name: '@timestamp'
+  type: date
+  description: Event timestamp.
+- name: input.type
path: packages/o365_metrics/data_stream/tenant_settings/fields/base-fields.yml
user: login: ritalwar
body: This is not needed; we can remove it, and it will still appear in the events.
created_at: 2025-03-24T11:23:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: ritalwar
body: Add processors as well:

```
       - name: processors
        type: yaml
        title: Processors
        multi: false
        required: false
        show_user: false
        description: >
          Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.
```
created_at: 2025-03-24T11:32:34Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,15 @@
+- name: data_stream.type
+  type: constant_keyword
+  description: Data stream type.
+- name: data_stream.dataset
+  type: constant_keyword
+  description: Data stream dataset.
+- name: data_stream.namespace
+  type: constant_keyword
+  description: Data stream namespace.
+- name: '@timestamp'
+  type: date
+  description: Event timestamp.
+- name: input.type
path: packages/o365_metrics/data_stream/tenant_settings/fields/base-fields.yml
user: login: tommyers-elastic
body: the system test fails without it
created_at: 2025-03-24T11:53:38Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: tommyers-elastic
body: is this just something we are offering for every data stream as standard in the package?
created_at: 2025-03-24T11:54:15Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: ritalwar
body: > is this just something we are offering for every data stream as standard in the package?


Yes, that's what I've seen.

I mentioned it because I see you're handling the processor config in the cel code, so it needs to be added here to use them.
created_at: 2025-03-25T03:18:47Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: tommyers-elastic
body: got it. thanks. 
created_at: 2025-03-25T09:11:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: tommyers-elastic
body: if it's common, can we add it in the top level config?
created_at: 2025-03-25T09:17:28Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: ritalwar
body: That makes sense, we should do that.
created_at: 2025-03-25T09:18:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: tommyers-elastic
body: 👍 will open a PR with the changes
created_at: 2025-03-25T09:20:23Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,40 @@
+title: "Tenant settings"
+type: metrics
+streams:
+  - input: cel
+    title: Microsoft 365 tenant settings
+    enabled: false
+    description: Collect information about tenant-level settings for Microsoft 365.
+    template_path: cel.yml.hbs
+    vars:
path: packages/o365_metrics/data_stream/tenant_settings/manifest.yml
user: login: ritalwar
body: Let me correct myself: I think we should keep it at the data stream level, so users can have different processors for each data stream if needed.
created_at: 2025-03-25T09:24:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,68 @@
+{
+    "o365": {
+        "metrics": {
+            "tenant_settings": {
+                "display_concealed_names": true,
+                "tenant": {
+                    "id": "f99cbd5a-95d6-4767-9372-0d41ca2ead9d",
+                    "type": "AAD",
+                    "display_name": "azure2"
+                }
+            }
+        }
+    },
+    "input": {
+        "type": "cel"
+    },
+    "agent": {
+        "name": "elastic-agent-19515",
+        "id": "37f1ae71-1a03-4d62-82e0-59e440f35824",
+        "ephemeral_id": "b19c8d15-4089-4209-ad9e-fab4e4491827",
+        "type": "filebeat",
+        "version": "8.17.3"
+    },
+    "@timestamp": "2025-03-24T14:49:05.173Z",
+    "ecs": {
+        "version": "8.0.0"
path: packages/o365_metrics/data_stream/tenant_settings/sample_event.json
user: login: ritalwar
body: To have the latest ECS version, we may need to configure it in the pipeline.
created_at: 2025-03-25T09:52:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -28,6 +28,7 @@ Following Microsoft 365 Graph Reports can be collected by Microsoft Office 365 M
 | [Service Health](https://learn.microsoft.com/en-us/graph/service-communications-concept-overview?view=o365-worldwide)                                                 |    [reportRoot: getServiceHealth](https://learn.microsoft.com/en-us/graph/api/servicehealth-get?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Service Health metrics   |   No aggregation  |
 | [Subscriptions](https://learn.microsoft.com/en-us/graph/api/resources/subscribedsku?view=graph-rest-1.0?view=o365-worldwide)                                                 |    [reportRoot: subscribedSkus](https://learn.microsoft.com/en-us/graph/api/subscribedsku-list?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Subscriptions metrics   |   No aggregation  |
 | [Teamms Call Quality](https://learn.microsoft.com/en-us/graph/api/resources/communications-api-overview?view=graph-rest-1.0?view=o365-worldwide)                                                 |    [reportRoot: callRecords](https://learn.microsoft.com/en-us/graph/api/callrecords-callrecord-list-sessions?view=graph-rest-1.0&tabs=http)    |   Microsoft 365 Teams Call Quality metrics   |   No aggregation  |
+| Tenant Settings | [organization](https://learn.microsoft.com/en-us/graph/api/resources/organization?view=graph-rest-1.0), [adminReportSettings](https://learn.microsoft.com/en-us/graph/api/resources/adminreportsettings?view=graph-rest-1.0) | Microsoft 365 Tenant Settings | No aggregation |
path: packages/o365_metrics/docs/README.md
user: login: ritalwar
body: I see the pipeline is failing. We need to update this change in README in `dev/build/docs/README`, and the package build will automatically update `docs/README` instead of making the change here directly.
created_at: 2025-03-25T10:08:14Z
author_association: CONTRIBUTOR
diff_hunk: @@ -0,0 +1,68 @@
+{
+    "o365": {
+        "metrics": {
+            "tenant_settings": {
+                "display_concealed_names": true,
+                "tenant": {
+                    "id": "f99cbd5a-95d6-4767-9372-0d41ca2ead9d",
+                    "type": "AAD",
+                    "display_name": "azure2"
+                }
+            }
+        }
+    },
+    "input": {
+        "type": "cel"
+    },
+    "agent": {
+        "name": "elastic-agent-19515",
+        "id": "37f1ae71-1a03-4d62-82e0-59e440f35824",
+        "ephemeral_id": "b19c8d15-4089-4209-ad9e-fab4e4491827",
+        "type": "filebeat",
+        "version": "8.17.3"
+    },
+    "@timestamp": "2025-03-24T14:49:05.173Z",
+    "ecs": {
+        "version": "8.0.0"
path: packages/o365_metrics/data_stream/tenant_settings/sample_event.json
user: login: tommyers-elastic
body: done
created_at: 2025-03-26T09:30:31Z
author_association: CONTRIBUTOR

PR comments:
user: login: elastic-vault-github-plugin-prod[bot]
created_at: 2025-03-19T14:30:54Z
body: ### :rocket: Benchmarks report




To see the full report comment with `/test benchmark fullreport`
<!--COMMENT_GENERATED_WITH_ID_benchmark-report-->
author_association: NONE
user: login: lucian-ioan
created_at: 2025-03-21T11:20:30Z
body: 1. Add `sample_event` and update [readme](https://github.com/elastic/integrations/blob/main/packages/o365_metrics/_dev/build/docs/README.md).

2. Add changelog entry and bump version.

3. `DisplayConcealedNames` is already a boolean in the response, so an ingest pipeline is likely unnecessary. The only potential check would be for CEL failures, but such failures are handled in the CEL code:
   ```  
   - fail:  
       tag: cel_failure  
       if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null  
       message: error message set and no data to process  
   ```  

Looks good!
author_association: CONTRIBUTOR
user: login: elastic-sonarqube[bot]
created_at: 2025-03-27T10:55:44Z
body: ## [![Quality Gate passed](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonar.elastic.dev/dashboard?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170) **Quality Gate passed**  
Issues  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&resolved=false) [0 New issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&resolved=false)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/fixed-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&fixedInPullRequest=13170) [0 Fixed issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&fixedInPullRequest=13170)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/accepted-16px.png '')](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&issueStatuses=ACCEPTED) [0 Accepted issues](https://sonar.elastic.dev/project/issues?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&issueStatuses=ACCEPTED)

Measures  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/security_hotspots?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170) [0 Security Hotspots](https://sonar.elastic.dev/security_hotspots?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&metric=new_coverage&view=list) [96.7% Coverage on New Code](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&metric=new_coverage&view=list)  
[![](https://raw.githubusercontent.com/SonarSource/sonarqube-static-resources/master/v104/common/passed-16px.png '')](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&metric=new_duplicated_lines_density&view=list) [0.0% Duplication on New Code](https://sonar.elastic.dev/component_measures?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube](https://sonar.elastic.dev/dashboard?id=elastic_integrations_AYu5LCaKQZlFqhqWIrk_&pullRequest=13170)


author_association: NONE
user: login: elasticmachine
created_at: 2025-03-27T10:55:55Z
body: ## :green_heart: Build Succeeded
* [Buildkite Build](https://buildkite.com/elastic/integrations/builds/23953)
* Commit: ae6b4eaffe32f9f04025bee840328536775617c8

### History
* :green_heart: [Build #23888](https://buildkite.com/elastic/integrations/builds/23888) succeeded 3327dc6ca317a44443862279fd99fe32f9a5f832
* :broken_heart: [Build #23870](https://buildkite.com/elastic/integrations/builds/23870) failed 15461c4524ec4215a6442bd1e905e95ec7281e21
* :broken_heart: [Build #23859](https://buildkite.com/elastic/integrations/builds/23859) failed 15461c4524ec4215a6442bd1e905e95ec7281e21
* :broken_heart: [Build #23790](https://buildkite.com/elastic/integrations/builds/23790) failed 1527a2320300d5ef2f09fb3b66f65ee4873c3f10
* :broken_heart: [Build #23787](https://buildkite.com/elastic/integrations/builds/23787) failed 14813322d461783a7348e801f982dd922499a438
* :green_heart: [Build #23751](https://buildkite.com/elastic/integrations/builds/23751) succeeded 38a4ba9d228da6b71fd8732c13fc69a51e513d69

<!--buildkite-pr-comment-integrations
{"builds":[{"buildStatus":{"state":"passed","success":true,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/23953","number":23953,"commit":"ae6b4eaffe32f9f04025bee840328536775617c8"},{"buildStatus":{"state":"passed","success":true,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/23888","number":23888,"commit":"3327dc6ca317a44443862279fd99fe32f9a5f832"},{"buildStatus":{"state":"failed","success":false,"hasRetries":true,"hasNonPreemptionRetries":true},"url":"https://buildkite.com/elastic/integrations/builds/23870","number":23870,"commit":"15461c4524ec4215a6442bd1e905e95ec7281e21"},{"buildStatus":{"state":"failed","success":false,"hasRetries":true,"hasNonPreemptionRetries":true},"url":"https://buildkite.com/elastic/integrations/builds/23859","number":23859,"commit":"15461c4524ec4215a6442bd1e905e95ec7281e21"},{"buildStatus":{"state":"failed","success":false,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/23790","number":23790,"commit":"1527a2320300d5ef2f09fb3b66f65ee4873c3f10"},{"buildStatus":{"state":"failed","success":false,"hasRetries":false,"hasNonPreemptionRetries":false},"url":"https://buildkite.com/elastic/integrations/builds/23787","number":23787,"commit":"14813322d461783a7348e801f982dd922499a438"}],"number":23953}
buildkite-pr-comment-->
author_association: NONE
user: login: elastic-vault-github-plugin-prod[bot]
created_at: 2025-03-27T14:23:22Z
body: Package o365_metrics - 0.7.0 containing this change is available at https://epr.elastic.co/package/o365_metrics/0.7.0/
author_association: NONE