1.1 Overview
SendGuard365 logs user action confirmations made through SendGuard prompts or the SendGuard Taskpane. These user actions are recorded in an Azure Table Storage table within your organisation’s own Azure Storage account.
The logs are available through the SendGuard User Action Report in the SendGuard Management Console, allowing authorised administrators and other designated users to review and analyse user actions.
SendGuard uses two separate access mechanisms:
- Logging: SendGuard uses a connection string configured in the SendGuard M365 settings to write log entries to Azure Table Storage.
- Reporting: The Licenses Management Console reads the logs on behalf of the signed-in user, using delegated Azure Storage permissions and the user's Azure role assignments.
The logging connection string is used for writing data and locating the logging table. It is not used to read log entries.
Your organisation retains control over the storage account, data access, network restrictions and retention policies.
1.2 Create Azure Storage and configure logging
2. From Azure Portal click on Create a Resource button.
3. From Azure marketplace select Infrastructure Services, then select Storage account
4. Fill the storage account name and location, and other settings as shown below, then click review + create button.
5. Your account has successfully been created.
1.3 Connecting to Azure Storage
- Open the storage account and navigate to Security + networking → Shared access signature
- Configure the required permissions with the principle of least privilege (Refer to screenshots below), then select Generate SAS and connection string.
- Copy the connection string field
- Enter the connection string in your SendGuard M365 settings.
The connection string is used to write logs and locate the table, not to read log entries. Keep it secure and grant only the permissions required for logging.
- Verify that the SendGuardUserActionLogsV2 table is receiving entries.
2. How to View User Action Report
2.1 Overview
The User Action Report in the SendGuard Licenses Management Console shows the user-action logs that SendGuard writes to your own Azure Storage table (SendGuardUserActionLogsV2). To display them, SendGuard reads that table as the signed-in user, using a delegated Azure Storage permission. SendGuard has no access of its own, and the logs never leave your storage account except to be shown in the user's browser.
The logging connection string SendGuard holds is write-only. It is used to write logs and to locate your table, never to read it.
2.2 How access works
A user sees logs only when two independent checks both passes. Your organization controls both.
Gate 1 (Entra ID consent) decides whether SendGuard may act on behalf of the user.
Gate 2 (Azure RBAC) decides whether that user may read the table.
Consent alone opens nothing: a user without Storage Table Data Reader gets a 403.
2.3 What admin consent does and does not allow
Admin consent pre-approves SendGuard for everyone in your organization, so users aren't prompted. It does not give SendGuard or any user access to your data.
| Admin consent... |
|
| Does | Let SendGuard call Azure Storage on behalf of a signed-in user, without a per-user consent prompt. |
| Does not | Grant any user access to the log table. Only users with a data role (gate 2) can read it, including the admin who consented. |
| Does not | Let SendGuard read data in the background. The permission is delegated: reads happen only while a user is signed in and viewing the report. |
| Does not | Grant access to other storage accounts. A user can only read what their own Azure role allows. |
Permission requested: Azure Storage → user_impersonation (delegated, Access Azure Storage as the signed-in user).
2.4 Security and privacy
SendGuard reads your logs as the signed-in user, displays them in the browser, and does not store or copy them.
- No data at rest: log rows are loaded for the page request and rendered. They are not written to any SendGuard database, file or log.
- Tokens only: the console caches the user's Azure Storage access token for the session so pages load without re-signing in. Tokens are not log data and expire automatically.
- Audited per user: every read appears in your storage diagnostic logs as AuthenticationType = OAuth with the user's UPN, so you can see exactly who viewed the logs.
- Your storage, your rules: the data stays in your storage account, under your retention, firewall and access policies.
2.5 Setup steps for Admins
Three one-time steps enable the report for your organization.
- Grant consent. A Global, Cloud Application or Application Administrator opens the report once (or the consent link SendGuard shows), ticks Consent on behalf of your organization, and accepts.
- Assign the data role. In the Azure portal, open the logging storage account → Access control (IAM) → Add role assignment → Storage Table Data Reader→ add the users or group who should view reports. Owner or Contributor alone is not enough.
- CLI alternative: az role assignment create --assignee <user-or-group> --role "Storage Table Data Reader" --scope <storage-account-resource-id>
- Allow 5–10 minutes for the role to take effect.
- Check the firewall. If the storage account restricts network access, allow the SendGuard console's outbound IP addresses (provided by SendGuard support).
To confirm consent: Entra admin center → Enterprise applications → SendGuard Licenses Management Console → Permissions → Admin consent should list Azure Storage user_impersonation.
2.6 Revoking access
- One user or group from viewing logs: Remove their Storage Table Data Reader role assignment.
- SendGuard from reading storage for anyone: Entra → Enterprise applications → SendGuard Licenses Management Console → Permissions → revoke Azure Storage user_impersonation
Revoking report access does not affect SendGuard licensing or the Outlook add-in. Logging continues as long as the logging connection string remains valid and has the required permissions.
2.7 Troubleshooting
Issue | Check |
No logs appear | Verify the connection string, write permissions and logging table. |
Report returns 403 | Check admin consent and the user's Storage Table Data Reader role. |
Report cannot connect | Check storage firewall and network settings. |
Access was recently assigned | Allow 5–10 minutes for changes to take effect. |