diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 70c129b86975..b8d4ded7a1b0 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -257,6 +257,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 *Filebeat*
 
 - Deprecate `syslog` input in favor of `syslog` processor. {issue}37555[37555] {pull}38277[38277]
+- Deprecate `o365audit` input in favor of `CEL` input. {issue}37719[37719] {pull}[]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc b/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc
index 62ec3880c256..e822f5e7e98a 100644
--- a/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc
+++ b/x-pack/filebeat/docs/inputs/input-o365audit.asciidoc
@@ -5,6 +5,10 @@
 [id="{beatname_lc}-input-{type}"]
 === Office 365 Management Activity API input
 
+deprecated:[8.14.0]
+
+The o365audit input is deprecated. Similar functionality can be achieved using the <<filebeat-input-cel,`CEL input`>> .
+
 ++++
 <titleabbrev>Office 365 Management Activity API</titleabbrev>
 ++++
diff --git a/x-pack/filebeat/input/o365audit/input.go b/x-pack/filebeat/input/o365audit/input.go
index 3793ce43d6aa..b01ba98ac907 100644
--- a/x-pack/filebeat/input/o365audit/input.go
+++ b/x-pack/filebeat/input/o365audit/input.go
@@ -55,7 +55,7 @@ func Plugin(log *logp.Logger, store cursor.StateStore) v2.Plugin {
 	return v2.Plugin{
 		Name:       pluginName,
 		Stability:  feature.Experimental,
-		Deprecated: false,
+		Deprecated: true,
 		Info:       "O365 logs",
 		Doc:        "Collect logs from O365 service",
 		Manager: &cursor.InputManager{