Microsoft 365

The Microsoft 365 connector reads your Microsoft Entra directory, SharePoint and OneDrive changes, Teams apps and Copilot through Microsoft Graph. How the connect flow works is on How connectors work.

Who can do it

Connecting needs connections:manage (Manage connections), held by Owner, Admin and Fleet operator. On Microsoft's side, a Global Administrator of your Microsoft tenant has to accept the permissions. Microsoft's word, tenant, means your Microsoft directory here.

Connect

1. Go to Collection › Connectors and choose Connect on Microsoft 365.
2. Give the connection a Name, and choose Modes (at least one):
   • Identity: Microsoft Entra users, groups, directory roles, enterprise applications and their grants, conditional access, sign-ins and audits.
   • Microsoft 365: SharePoint and OneDrive changes and sharing links, Teams apps and the organisation's app catalogue.
   • Copilot: Microsoft 365 Copilot usage per licensed user and, opted in, the interactions themselves.
3. Sign in with one of two methods:
   • Grant Oxelone admin consent on Microsoft Entra. The hint reads "Microsoft asks a Global Administrator of your tenant to accept the permissions Oxelone requests, then to sign in as that administrator, then sends you back here." This method is offered once a global admin has registered Oxelone's app.
   • Your own registration. Upload a JSON file with tenant_id, client_id and client_secret from a registration your directory owns. The hint reads "A JSON file with tenant_id, client_id and client_secret from a registration your tenant owns."
4. Continue through Check and Rules, then choose Create connection.

On Microsoft's side

For Your own registration, register an app in the Microsoft Entra admin center. Microsoft's steps are: sign in as at least an Application Developer, go to Entra ID › App registrations, choose New registration, name it, choose Single tenant only for most apps, choose Register, and record the Application (client) ID. The Graph permissions the connector reads with are listed under What it needs to be Readable below.

Vendor documentation: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app

What it reads

Mode: Identity

Mode: Microsoft 365

Mode: Copilot

What it can do

All need the matching Graph write permission.

What it checks

Twelve posture checks, no inspections.

What it needs to be Readable

Reads need these Microsoft Graph application permissions: User.Read.All, Group.Read.All, GroupMember.Read.All, RoleManagement.Read.Directory, AuditLog.Read.All, Policy.Read.All, Sites.Read.All, Files.Read.All, TeamsAppInstallation.Read.Group, AppCatalog.Read.All, Application.Read.All, Directory.Read.All and Reports.Read.All. Copilot interactions also need AiEnterpriseInteraction.Read.All.

Actions need: User.EnableDisableAccount.All, User.RevokeSessions.All, GroupMember.ReadWrite.All, AppRoleAssignment.ReadWrite.All, Application.ReadWrite.All, Files.ReadWrite.All, TeamsAppInstallation.ReadWriteForTeam.All and DelegatedPermissionGrant.ReadWrite.All.

Copilot usage and Copilot interactions also need Microsoft 365 Copilot in the plan. Without it the row reads "Not readable — the organisation's plan does not include this (Microsoft 365 Copilot)."

Sync period

1 h, 6 h and 1 d. There is no 15-minute period.

When it goes wrong

The messages are the shared ones on How connectors work. The ones specific to this sign-in:

With the API

Not available with an API key.