Office365 Monitoring using System Centre Operations Manager

Editor’s note: The following post was written by Office365 MVP Geoff Evelyn as part of our Technical Tuesday series.
One of the most compelling challenges for Office 365 is centralised monitoring. Those working in the SharePoint arena will know only too well importance of monitoring and reporting across the platforms they manage. This is not simply from a technical but also from proof of service; the availability and evolution of those services. Proof that, the team responsible for monitoring internal SharePoint resources and servers also have a level in comfort in providing likewise monitoring for Office 365. Evolution to be able to identify over time changes in the services provided so that there are no surprises to stakeholders (both technical and business). Particularly for those organisations using centralised monitoring tools such as System Centre Operations Manager for monitoring infrastructure, the issue would be how to include service provision monitoring which exists outside of the on-premise infrastructure, so that it is possible to centralise alerting, notification, messages from those external service into on-premise environment monitoring.
From the Office365 angle, there is a wealth of monitoring availability all available from the Office 365 Dashboard available on each tenant (otherwise known as a subscription) in the Admin section of Office 365. This is a per tenant centralised provision giving service overviews and health covering all Office 365 services (Exchange, Identity Service, Portal, Rights Management, SharePoint, Skype and Yammer). There is also the Service Health page giving 30 days service level history concerning Office 365 features, including a page giving planned maintenance information.
From a service monitor perspective, whilst this is of course presents great options, there could be some challenges. If there are a number of Office 365 tenants to manage, things can become quite unwieldy if not virtually impossible in trying to identify service status from a single point. Additionally, additional conundrums arise when faced with managing hybrid and disconnected services, such as on-premise SharePoint (including associated services), and separated Office 365 tenants for external clients and partners. The key difficulty therefore, is the ability to monitor messages, alerts and notifications from the multitude of Office365 tenants without having to hop between monitoring systems pages in each.
System Centre Operations Manager 2012 R2 is a great monitoring tool of choice when it comes down to identifying service levels and performance for on-premise infrastructure. System Centre Operations Manager 2012 R2 crucially provides a unified management platform that covers service provider and azure environments. Service provider and Azure environments simply need to be added using 'Management Packs'. Microsoft have released an Office 365 Management Pack which provides System Centre Operations Manager 2012 R2 the ability to connect into Office 365 tenants. This is seen as a method by which the issues described above could be solved.
This article will describe how to download the Office 365 Management Pack, import and then use the services and features in that Management Pack.
1 A note about installing System Centre 2012
The key pre-requisite of the Office 365 Management Pack is System Centre Operations Manager 2012 R2. This article does not altogether assume you have installed it, or even are knowledgeable about the product. Therefore, for those not sure how to install System Centre Operations Manager 2012, it is a comprehensive and depending how deeply you wish to go, quite involved. There is a lot of information out there and links to that information is given in the Summary section.
I decided to go for a test installation, to help me write this article instead of using my full blown System Centre Operations Manager. I deployed System Centre Operations Manager into a single server VM. Information, specifics of the VM and installation guides on how to do that is also given in the Summary section.
2 What is the Office365 Management Pack
Basically, the pack allows you to use the administrative section of System Centre Operations Manager to add Office 365 Subscriptions. This is an important step since you would enter all the tenants that you need to monitor and is particularly useful in the dashboard. Once done, you can then use the discover services and features available for each of the subscriptions. Those features include the ability to get notified when Office 365 incidents occur, and visualise those alerts in the included dashboard.
The management pack, once deployed communicates with the relevant subscribed tenants to obtain information from Office 365 features, services and subscription. The below screen-shot shows the monitoring dashboard which gives the sections of information available, such as service status, active and resolved incidents and the message centre. 
 
 
3 Installing the Management Pack
The Office 365 Management pack includes basic instructions for installation. I followed this guide to implement ten Office 365 subscriptions. Once the pack is installed into System Centre Operations Manager, you will need to ensure that you can configure System Centre Operations Manager to communicate and discover information from the Office 365 tenant.
Essentially, what needs to be done is:
1. Implement a special account in the Office 365 tenant which has administrative access to the tenant so that System Centre Operations Manager can subscribe to that tenant.
2. Configure the tenant as a subscription
3. Customise your System Centre Operations Manager Workspace so that you have a centralised dashboard
3.1 Installing the Pack to Disc
The following procedure describes how to install the management pack for Office 365.
First, download the Management Pack. The link is located below.
1: Run the MSI: 
 
 
2: Choose the default directory.  

 
3: Confirm the installation of the MSI:

Note the installation directory which is where the pack will be installed to. You will need to import the pack once this procedure is completed.
3.2 Importing the Pack into System Centre
Once the pack is installed, you will need to visit the System Centre Operations Manager, go into the Administrative section, to install the management pack.
1: Access System Centre Operations Manager Administration, then access the Management Packs section.
Once in the management packs section, you will need to Import the Management Pack for Office365. The following screen-shot shows the Management Pack selection area, and the Import Management Packs section. 

  
The Import Management Packs section is where you will select the downloaded Office 365 Management Pack. When done, the next dialog displayed is the Import Management Packs dialog. Since we downloaded the management pack, we simply take it from disk. 
 
 
You will see an Online Catalog Connection dialog (shown below) asking if you would like to search the online catalog for dependencies. This is not required for the Office 365 management pack, so you can select NO from that dialog.

 
Locate the downloaded Management Pack, and then you will be presented with information concerning its version, release date, status, and license terms. The Office Management pack only shows the initial version of 7.0.5115.0 (shown below).

 
At this stage, we all ready to carry out the installation of the Office 365 Management pack. Select install to proceed with the installation. Once done, you will notice the Management Pack listed in the Administration pane.
3.3 Adding Office 365 Subscriptions
The key benefit of using Office 365 in System Centre Operations Manager 2012 is the ability to monitor multiple subscriptions (tenants) from one dashboard. The next thing to configure the management pack is to add all the subscriptions that needs to be monitored. This is done by accessing the Office365 Subscriptions page which is located in the Administration pane.

 
The Office 365 subscription panel will be displayed when selecting the Office 365 option from the Administration pane. Here, you can add, edit or delete subscriptions. Each subscription requires that an Office 365 account is defined so that the subscription can be saved in System Centre Operations Manager. Each subscription requires an account is specifically set in the relevant Office 365 tenants. That account is then used to connect System Centre Operations Manager to the relevant tenant. To do this, access the Office 365 tenant admin page. Go into the Active Users page, and then add a new user, and do not assign any licenses to that user. Assign that user admin rights. Note the username and the password.
Then, access the subscription panel by selecting the Office 365 option from the Administration pane in System Centre Operations Manager. That will display the Office 365 subscription panel. Click Add subscription to add the name of the tenant, the user name and password as created in Office 365 users. The below screen-shot shows an example:

 
Select the NEXT button once you have entered the subscription details for the Office 365 tenant that you wish to monitor. Doing this will display the option to select a Management Server Resource Pool. Resource pools are pretty cool. They ensure the continuity of monitoring by providing multiple management servers that can take on monitoring workflows if one of the management servers becomes unavailable. You can create resource pools for specific purposes. For example, you might create a resource pool of management servers that are located in the same geographic area to provide network device monitoring. When System Centre Operations Manager is installed the default pool is the 'All Management Servers Resource Pool'.
For the purpose of the installation of a subscription you could choose the All Management Servers Resource Pool. If you are interested in utilising Resource Pools in the future or wish to find out more information, check out the link given in the Summary section. The below screen-shot shows the selection of the All Management Servers Resource pool as part of adding a new subscription.

Once you have selected the resource pool, select the Add Subscription button. This will then add the subscription into the Subscriptions panel. Repeat this process to add any other relevant Office 365 tenants.
 
4 Setting Out your Workspace
Now onto the setting up of the various dashboards, alerts, and notifications available in the Office 365 Management Pack. First, we will need to select the areas we want to monitor and add them into the Workspace. Before doing that, we will need to appraise the contents of the management pack.
To do this, access the Monitoring section of System Centre Operations Manager, then expand the Office 365 section in the Monitoring pane.

 
The Office 365 section shows two areas of monitoring available to you.
· Active Alerts shows information about each incident occurred across all the subscriptions applied in the System Centre Operation Manager Office 365 subscriptions list. Active alerts will get generated for each Active or Resolved incident. This includes, for each alert, the resolution state, how old the alert is, and the priority assigned. Each alert can be expanded to show more information including full description of the incident and methods to alter who should be assigned the alert for example.
· Office 365 Monitoring Dashboard (a screen shot is shown here) shows information for all the subscriptions and status indicator against each of the Office 365 subscriptions. There are five segments (otherwise known as widgets) in the dashboard:
1. Subscription Health. The health (icon - red/yellow/green) and name of the subscription. Each subscription can be selected. When a subscription is selected, System Centre Operations Manager will drill down and display in the other segments status, incidents and messages to the subscription selected.
2. Service Status. Shows the name of the services available in the subscription and for each the number of active incidents.
3. Active Incidents. Shows the Severity (status icon - red/yellow/green), the source (subscription), the kind of incident, description, status, affected services and the ID of the incident.
4. Resolved Incidents. Shows the same information as the Active Incidents.
5. Message Centre. One of my favourite sections, of course :) - this shows information concerning general updates carried out in Office 365, in terms of items like What's New, Updated Features, What's around the corner and more.
 
The point about these two areas in the monitoring section is for you to then take these into your workspace and carry out customisation to suit your way of working. As said earlier, the My Workspace section allows you to centralise the Office 365 monitoring with any other monitoring of the infrastructure into one place which is easy to locate.
To do this, you will need to right-click the area in the monitoring pane to display the context menu (see the below screen-shot). From that menu select 'Add to My Workspace'. Once done, you will need to enter a title for the area, and a group that it will appear in.

I went and did this for the Active Alerts and the Office 365 Monitoring Dashboard, and then I visited the My Workspace section (screen-shot below).

The My Workspace section shows the areas of monitoring that you have decided you want to monitor. On mine, I want to monitor SharePoint 2013 on-premise, Windows Computers, Service State and Office 365. Let’s take a look at the two areas in question, Active Alerts, and the Monitoring Dashboard.
 
4.1 Active Alerts
Office 365 Active Alerts allows you to get a central view of all messages concerning the incidents on all the subscriptions in one window. You can personalise the view and select columns you wish displayed. You can also the sorting and grouping. You can also rename the title of the view so that you can recognise it easily in the other areas that you have listed in the Workspace area. For example, SharePoint 2013 Management Pack has Active Alerts section in it, so it probably is important to rename so it’s clear which is which when displayed with the Office 365 Management Pack Active Alerts section. The below screen-shot shows the Workspace section, with the areas I want to monitor. The Active Alerts from Office 365 Management Pack has been added and customised. The title has been renamed, and I have added the description field to the list. I have sorted by Source then Severity. That means I can see messages grouped by the subscription (the Office 365 Tenant) and the severity (information, critical, etc.)

 
The following screen-shot shows two sources (two Office 365 tenants) showing clearly that the authorization to the second has failed (most likely a password incorrectly entered). The key thing here is the fact that you can see the critical messages against each source.
 

Each alert displayed can be drilled into to obtain further information. For example, on the first item displayed in the above screen-shot (Resolved Incident MO25200) I can bring up the Alert Context to understand more about the incident and what was done to resolve the issue. Of course, this information could be obtained on the portal, but doing this in the Operations Manager centrally is definitely more productive!
 

Additionally, each alert can give me more information about how to solve the issue. For example, one of my tenants was not able to authorize against System Centre. By bringing up the Product Knowledge on the alert I was able to see ways in which I could solve the issue. 18

Each alert can be controlled in terms of management. You can assign individuals and Ticket IDs to the alert. You can also, once the alert issue has been resolved mark it as Closed. This will remove the alert so that you can concentrate on the unresolved incidents.

 
4.2 The Monitoring Dashboard
The Monitoring Dashboard centralises all active, resolved, service status and all messages into one dashboard. The great aspect about the dashboard is the ability to filter messages.
 

5 Summary
System Center 2012 Operations Manager R2 is designed to help configure and manage applications, services, computers, and VMs in mid-sized to large enterprises. The Office 365 Management Pack adds the ability for those using this tool to extend the monitoring into one or more Office 365 under their control. This article shows just a fraction of the ability that there is using the Office 365 Management Pack. Whilst on my voyage of discovery I noted other very useful items which in the context of service delivery are vitally important.
· Reporting - the ability to view over time aspects such as availability, uptime, configuration changes.
· Custom field manipulation to store more information concerning Alerts (help the monitoring system become more of a helpdesk)
· Override some of the ways the alert surfaces, such as priority, severity, etc.
 
I will be writing more about these features and options in further articles to explain more how System Centre 2012 R2 Operations Manager can be tailored and linked, and particularly where in the land of support they can be extremely useful.
 
5.1 More Information
There are places you should visit to get more information concerning System Centre 2012 R2 and the Office 365 Management Pack.
System Centre Operations Manager R2.
Gives overviews, features, purchasing, resources and the ability to evaluate System Centre Operations Manager 2012 R2.
https://www.microsoft.com/en-us/server-cloud/products/system-center-2012-r2/Overview.aspx
System Centre Operations Manager Management Pack for Office 365
Gives details, basic installation instructions, system requirements.
https://www.microsoft.com/en-gb/download/details.aspx?id=43708
How to work with Resource Pools in System Centre Operations Manager
A resource pool allows to you define collections of management servers used to distribute work amongst themselves including continuity.
https://technet.microsoft.com/en-gb/library/hh230706.aspx

About the author

With more than 30 years' experience in information technology and more than 10 years’ experience in SharePoint covering development, design and implementation. Geoff works in SharePoint information systems design, architecture, implementation, planning, governance and automation, all in the land of SharePoint service delivery. Geoff is a multiple author, a Fellow of the Institute of the Analysts and Programmers, a Fellow of  the Institute of Computer Technology, a Member of the Chartered Institute for IT and Engineering Technology, a Prince 2  Practitioner, and an MVP Mentor.