What is the BOXServiceAccount and what is it doing?
Office 365 Audit Records Reveal Interesting Events
Over the last few days, I’ve noticed records being generated in the Office 365 audit log for an account called BOXServiceAccount. You can see an example above. The audit records are matched by alert policies (managed through the Security and Compliance Center) that cause email to be sent to my account when events that might need investigation occur. In this case, a use of Exchange Online administrative permission by an account.
An activity alert flagged by Office 365
A quick internet search turned up this Microsoft support article, which throws some light on the subject. Although the wording is odd (for example, “BOXServiceAccount is added to a role” is more likely “BOXServiceAccount is used to add an account to a role.”), the intent is clear. BOXServiceAccount is a system account used behind the scenes to carry out tasks within Office 365. A discussion in the Microsoft Technical Community from April 2018 and another in the Microsoft Answers forum from June 2017 provided some extra insight. Clearly, I haven’t been paying attention.
In this case, it seems like BOXServiceAccount comes into play when an administrator assigns another user one of the custom administrative roles through the Office 365 Admin Center. I assume the reason why a system account is used in this manner is that the administrator who assigns someone a role might not have the permission to add that account to the Azure Active Directory role groups which underpin the administrative roles.
Azure Active Directory Role Groups
To see the role groups defined in your tenant, run the Get-AzureADDirectoryRole cmdlet (from the Azure AD PowerShell V2 module).
Get-AzureADDirectoryRole
ObjectId DisplayName Description
-------- ----------- -----------
07308ce7-381b-4fb1-b31e-398b8a66c946 Billing Administrator Can perform common billing related tasks like updating payme...
0f3a91cd-4fdd-436e-97ed-f2a01b19bfe2 User Account Administrator Can manage all aspects of users and groups, including resett...
1402c923-f478-4a9c-82b1-0511726c43bd Customer LockBox Access Approver Can approve Microsoft support requests to access customer or...
268030c9-556f-47a6-a167-5970cb734558 Device Administrators Device Administrators
36333bfe-4ff2-452a-a4a0-d11a668b44c7 Company Administrator Can manage all aspects of Azure AD and Microsoft services th...
387f95ae-e47f-4156-b5d3-2d9150fdea7e Directory Readers Can read basic directory information. For granting access to...
432e4ce3-ed50-4406-aeb6-1794283ad211 Lync Service Administrator Can manage all aspects of the Skype for Business product.
4e0cabe2-fe25-49e1-8538-61a8b8422517 Reports Reader Can read sign-in and audit reports.
53add08e-5b0c-4276-a582-9ce02fb6c947 Exchange Service Administrator Can manage all aspects of the Exchange product.
57122a2b-cd95-4370-a84b-4e90ec8e722a Service Support Administrator Can read service health information and manage support tickets.
64503181-13d0-4ef6-8ee2-a08a7b690168 Power BI Service Administrator Can manage all aspects of the Power BI product.
7ae4b349-1f17-429c-8795-dcc56096c0c7 Helpdesk Administrator Can reset passwords for non-administrators and Helpdesk Admi...
88b6939a-ef4b-4e8e-9aba-00f4f8447e66 Compliance Administrator Can read and manage compliance configuration and reports in ...
c7ba418f-9d1e-4bd2-b770-dba1cbc2c336 Directory Writers Can read and write basic directory information. For granting...
f35c2f36-b60d-4b17-b261-0de8af7da552 SharePoint Service Administrator Can manage all aspects of the SharePoint service
The Lync Service Administrator listed is just an old display name. It equates to what you see as the Skype for Business Online Administrator when viewed through the Office 365 Admin Center. To see the current accounts assigned a role, run the Get-AzureADDirectoryRoleMember cmdlet and pass the object identifier of the role you want to examine.
Get-AzureADDirectoryRoleMember -ObjectId "f35c2f36-b60d-4b17-b261-0de8af7da552"
ObjectId DisplayName UserPrincipalName UserType
-------- ----------- ----------------- --------
d44088a5-a5ea-47af-b724-cffb12c6ed3e Paul Smith Paul.Smith@office365itpros.com Member
d446f6d7-5728-44f8-9eac-71adb354fc89 James Abrahams James.Abrahams@office365itpros.com Member
67105a51-e817-493e-8094-f600babf5f62 Marc Vigneau Marc.Vigneau@office365itpros.com Member
No Mystery – Move Along Please
So, apart from its odd name, there’s no mystery about BOXServiceAccount. It’s just one of the system accounts used by Office 365 to get work done. There’s nothing wrong with using accounts like this because system accounts have been used for years for different purposes, such as updating your Exchange Online configuration to match standards set by Office 365.
But what’s wrong is that Microsoft has never communicated the reason why BOXServiceAccount exists and how it is used. A note in the Message Center in the Office 365 Admin Center wouldn’t have gone amiss, well before administrators began to see the interesting audit events turn up in their Office 365 audit log. Maybe I missed that too.
For more information about custom Administrative roles, see Chapter 4 of the Office 365 for IT Pros eBook. And of course, you can have a great time reviewing the many interesting facts to be found in the Office 365 audit log in Chapter 21. And activity alerts and alert policies are covered in Chapter 21 too, just in case you don’t feel like browsing the audit log daily.
2 Replies to “What that BOXServiceAccount Does in Office 365”
In our case, one of our users was added to the Sharepoint Administrator role and then this alert popped up and see that same user also got automatically added to the View-Only Organization Management Role in Exchange. What is not clear is whether the user will get automatically removed from the Exchange role when the sharepoint role is removed.
{"id":null,"mode":"button","open_style":"in_modal","currency_code":"EUR","currency_symbol":"\u20ac","currency_type":"decimal","blank_flag_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/blank.gif","flag_sprite_url":"https:\/\/office365itpros.com\/wp-content\/plugins\/tip-jar-wp\/\/assets\/images\/flags\/flags.png","default_amount":100,"top_media_type":"featured_image","featured_image_url":"https:\/\/office365itpros.com\/wp-content\/uploads\/2022\/11\/cover-141x200.jpg","featured_embed":"","header_media":null,"file_download_attachment_data":null,"recurring_options_enabled":true,"recurring_options":{"never":{"selected":true,"after_output":"One time only"},"weekly":{"selected":false,"after_output":"Every week"},"monthly":{"selected":false,"after_output":"Every month"},"yearly":{"selected":false,"after_output":"Every year"}},"strings":{"current_user_email":"","current_user_name":"","link_text":"Virtual Tip Jar","complete_payment_button_error_text":"Check info and try again","payment_verb":"Pay","payment_request_label":"Office 365 for IT Pros","form_has_an_error":"Please check and fix the errors above","general_server_error":"Something isn't working right at the moment. Please try again.","form_title":"Office 365 for IT Pros","form_subtitle":null,"currency_search_text":"Country or Currency here","other_payment_option":"Other payment option","manage_payments_button_text":"Manage your payments","thank_you_message":"Thank you for supporting the work of Office 365 for IT Pros!","payment_confirmation_title":"Office 365 for IT Pros","receipt_title":"Your Receipt","print_receipt":"Print Receipt","email_receipt":"Email Receipt","email_receipt_sending":"Sending receipt...","email_receipt_success":"Email receipt successfully sent","email_receipt_failed":"Email receipt failed to send. Please try again.","receipt_payee":"Paid to","receipt_statement_descriptor":"This will show up on your statement as","receipt_date":"Date","receipt_transaction_id":"Transaction ID","receipt_transaction_amount":"Amount","refund_payer":"Refund from","login":"Log in to manage your payments","manage_payments":"Manage Payments","transactions_title":"Your Transactions","transaction_title":"Transaction Receipt","transaction_period":"Plan Period","arrangements_title":"Your Plans","arrangement_title":"Manage Plan","arrangement_details":"Plan Details","arrangement_id_title":"Plan ID","arrangement_payment_method_title":"Payment Method","arrangement_amount_title":"Plan Amount","arrangement_renewal_title":"Next renewal date","arrangement_action_cancel":"Cancel Plan","arrangement_action_cant_cancel":"Cancelling is currently not available.","arrangement_action_cancel_double":"Are you sure you'd like to cancel?","arrangement_cancelling":"Cancelling Plan...","arrangement_cancelled":"Plan Cancelled","arrangement_failed_to_cancel":"Failed to cancel plan","back_to_plans":"\u2190 Back to Plans","update_payment_method_verb":"Update","sca_auth_description":"Your have a pending renewal payment which requires authorization.","sca_auth_verb":"Authorize renewal payment","sca_authing_verb":"Authorizing payment","sca_authed_verb":"Payment successfully authorized!","sca_auth_failed":"Unable to authorize! Please try again.","login_button_text":"Log in","login_form_has_an_error":"Please check and fix the errors above","uppercase_search":"Search","lowercase_search":"search","uppercase_page":"Page","lowercase_page":"page","uppercase_items":"Items","lowercase_items":"items","uppercase_per":"Per","lowercase_per":"per","uppercase_of":"Of","lowercase_of":"of","back":"Back to plans","zip_code_placeholder":"Zip\/Postal Code","download_file_button_text":"Download File","input_field_instructions":{"tip_amount":{"placeholder_text":"How much would you like to tip?","initial":{"instruction_type":"normal","instruction_message":"How much would you like to tip? Choose any currency."},"empty":{"instruction_type":"error","instruction_message":"How much would you like to tip? Choose any currency."},"invalid_curency":{"instruction_type":"error","instruction_message":"Please choose a valid currency."}},"recurring":{"placeholder_text":"Recurring","initial":{"instruction_type":"normal","instruction_message":"How often would you like to give this?"},"success":{"instruction_type":"success","instruction_message":"How often would you like to give this?"},"empty":{"instruction_type":"error","instruction_message":"How often would you like to give this?"}},"name":{"placeholder_text":"Name on Credit Card","initial":{"instruction_type":"normal","instruction_message":"Enter the name on your card."},"success":{"instruction_type":"success","instruction_message":"Enter the name on your card."},"empty":{"instruction_type":"error","instruction_message":"Please enter the name on your card."}},"privacy_policy":{"terms_title":"Terms and conditions","terms_body":null,"terms_show_text":"View Terms","terms_hide_text":"Hide Terms","initial":{"instruction_type":"normal","instruction_message":"I agree to the terms."},"unchecked":{"instruction_type":"error","instruction_message":"Please agree to the terms."},"checked":{"instruction_type":"success","instruction_message":"I agree to the terms."}},"email":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email address"},"success":{"instruction_type":"success","instruction_message":"Enter your email address"},"blank":{"instruction_type":"error","instruction_message":"Enter your email address"},"not_an_email_address":{"instruction_type":"error","instruction_message":"Make sure you have entered a valid email address"}},"note_with_tip":{"placeholder_text":"Your note here...","initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"empty":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"not_empty_initial":{"instruction_type":"normal","instruction_message":"Attach a note to your tip (optional)"},"saving":{"instruction_type":"normal","instruction_message":"Saving note..."},"success":{"instruction_type":"success","instruction_message":"Note successfully saved!"},"error":{"instruction_type":"error","instruction_message":"Unable to save note note at this time. Please try again."}},"email_for_login_code":{"placeholder_text":"Your email address","initial":{"instruction_type":"normal","instruction_message":"Enter your email to log in."},"success":{"instruction_type":"success","instruction_message":"Enter your email to log in."},"blank":{"instruction_type":"error","instruction_message":"Enter your email to log in."},"empty":{"instruction_type":"error","instruction_message":"Enter your email to log in."}},"login_code":{"initial":{"instruction_type":"normal","instruction_message":"Check your email and enter the login code."},"success":{"instruction_type":"success","instruction_message":"Check your email and enter the login code."},"blank":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."},"empty":{"instruction_type":"error","instruction_message":"Check your email and enter the login code."}},"stripe_all_in_one":{"initial":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"empty":{"instruction_type":"error","instruction_message":"Enter your credit card details here."},"success":{"instruction_type":"normal","instruction_message":"Enter your credit card details here."},"invalid_number":{"instruction_type":"error","instruction_message":"The card number is not a valid credit card number."},"invalid_expiry_month":{"instruction_type":"error","instruction_message":"The card's expiration month is invalid."},"invalid_expiry_year":{"instruction_type":"error","instruction_message":"The card's expiration year is invalid."},"invalid_cvc":{"instruction_type":"error","instruction_message":"The card's security code is invalid."},"incorrect_number":{"instruction_type":"error","instruction_message":"The card number is incorrect."},"incomplete_number":{"instruction_type":"error","instruction_message":"The card number is incomplete."},"incomplete_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incomplete."},"incomplete_expiry":{"instruction_type":"error","instruction_message":"The card's expiration date is incomplete."},"incomplete_zip":{"instruction_type":"error","instruction_message":"The card's zip code is incomplete."},"expired_card":{"instruction_type":"error","instruction_message":"The card has expired."},"incorrect_cvc":{"instruction_type":"error","instruction_message":"The card's security code is incorrect."},"incorrect_zip":{"instruction_type":"error","instruction_message":"The card's zip code failed validation."},"invalid_expiry_year_past":{"instruction_type":"error","instruction_message":"The card's expiration year is in the past"},"card_declined":{"instruction_type":"error","instruction_message":"The card was declined."},"missing":{"instruction_type":"error","instruction_message":"There is no card on a customer that is being charged."},"processing_error":{"instruction_type":"error","instruction_message":"An error occurred while processing the card."},"invalid_request_error":{"instruction_type":"error","instruction_message":"Unable to process this payment, please try again or use alternative method."},"invalid_sofort_country":{"instruction_type":"error","instruction_message":"The billing country is not accepted by SOFORT. Please try another country."}}}},"fetched_oembed_html":false}
In our case, one of our users was added to the Sharepoint Administrator role and then this alert popped up and see that same user also got automatically added to the View-Only Organization Management Role in Exchange. What is not clear is whether the user will get automatically removed from the Exchange role when the sharepoint role is removed.
It’s easy to test…