Skip to main content

Microsoft 365

Visualize Microsoft 365 services, groups, and users, and monitor changes through queries and alerts.

Installation​

To use this integration, you must have:

  • An organizational Active Directory tenant to target for ingestion. The integration does not support the use of other tenant types.
  • An account in the tenant you want to target for ingestion that has global administrator access. You will log in with this account to grant the JupiterOne application API permissions that can read data across all users (admin consent).

Configuration in JupiterOne​

To install the Microsoft 365 integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select Microsoft 365. Click New Instance to begin configuring your integration, providing the following:

  • The Account Name used to identify the Microsoft 365 account in JupiterOne. Ingested entities will have this value stored in tag.AccountName when the AccountName toggle is enabled.

  • Description to assist in identifying the integration instance, if desired.

  • Polling Interval that you feel is sufficient for your monitoring needs. You may leave this as DISABLED and manually execute the integration.

After completing the authorization flow, the Tenant ID is automatically populated with the identifier for the Microsoft Active Directory tenant you authorized. This field is read-only.

Data Volume Configuration​

Control how much data is ingested from Microsoft 365 to manage storage and processing.

Data Filtering Options​

FieldDescriptionDefaultOptions
Included Vulnerability SeveritiesVulnerability severity levels to ingest. Filtering out lower severities reduces the volume of noncompliance findings.Low, Medium, High, CriticalUnknown, Informational, Low, Medium, High, Critical

Advanced Configuration​

FieldDescriptionDefault
Include Advanced Device DetailsWhen enabled, ingests additional device properties: physicalMemoryInBytes, iccid, and ethernetMacAddress. Additional API requests may extend ingestion duration.Disabled

SharePoint Scope​

These fields apply only when the SharePoint Sites, Document Libraries and Folders ingestion source is enabled. That source is off by default.

FieldDescriptionDefault
SharePoint Include PathsComma-separated SharePoint paths to ingest. Leave empty to ingest every site.Empty (everything)
SharePoint Exclude PathsComma-separated SharePoint paths to skip, along with everything below them.Empty (nothing)
SharePoint Folder DepthHow many folder levels below each document library root are ingested: 1, 2, 3, 5 or 10. Deeper levels take more API calls.3 levels

A path is the part of a SharePoint URL after the host name, decoded, for example /sites/Finance for a site, /sites/Finance/Shared Documents for its default document library, or /sites/Finance/Shared Documents/Audit/2024 for a folder. The root site's path is /. Paths are matched this way:

  • A path matches itself and everything below it. /sites/Finance/Shared Documents/Audit matches .../Audit/2024 but not .../Audit2. Matching is case-insensitive and works on whole path segments. Wildcards are not supported.
  • You can paste a URL copied from the browser instead of a path. The host is ignored, a library view such as /Forms/AllItems.aspx is dropped, and for a folder view URL (...AllItems.aspx?id=/sites/...) the folder in id is used.
  • Separate paths with commas. To match a name that contains a comma, write the comma as %2C.
  • With include paths set, a site, library or folder is ingested when it is at or below an include path, or when it is on the way to one, so the graph stays connected. This means the root site (/) is ingested whenever include paths are set, but its libraries are not unless they are included.
  • Exclusions win over inclusions. Nothing below an excluded path is read from Microsoft 365, even if an include path points inside it.
  • Folder depth is applied on top of the paths. An included folder deeper than the folder depth setting is not ingested.
  • A path that does not start with / (and is not a URL), or that contains * or ?, fails Test Credentials and integration runs with an error naming the path.

Excluding a path that was already ingested, narrowing the include paths, or lowering the folder depth removes the sites, libraries and folders that no longer match from JupiterOne on the next run, together with their relationships.

Site collections and their subsites are ingested as sites. OneDrive personal sites are never ingested, and files are not ingested; only sites, document libraries and folders are.

Click Create after you have provided all the values.

When prompted, click Begin Authorization.

You are then directed to the Microsoft identity platform where you must log in as a global administrator of the organizational Active Directory tenant you intend to integrate with.

You must select an account belonging to an organizational tenant. When you are already logged into an account, the badge icons indicate the nature of the tenant the account belongs to. Do not select a personal account.

Review the requested permissions (described below) and grant consent. Once you proceed through the authorization, you will have successfully completed the integration setup process.

Granted permissions​

  1. DeviceManagementApps.Read.All
    • Read Microsoft Intune apps
    • Needed for creating Application entities
  2. DeviceManagementConfiguration.Read.All
    • Read Microsoft Intune device configuration and policies
    • Needed for creating Configuration and ControlPolicy entities
  3. DeviceManagementManagedDevices.Read.All
    • Read Microsoft Intune devices
    • Needed for creating Device and HostAgent entities
  4. Organization.Read.All
    • Read organization information
    • Needed for creating the Account entity
  5. DeviceManagementServiceConfig.Read.All
    • Read Microsoft Intune configuration
    • Needed for enriching the Account entity with Intune subscription information and ingesting Windows Autopilot device identities
  6. DeviceManagementScripts.Read.All
    • Read Microsoft Intune device health scripts and their assignments
    • Needed for creating intune_device_health_script entities
  7. User.Read.All
    • Read all users' full profiles
    • Needed for creating User entities
  8. Group.Read.All
    • Read all groups
    • Needed for creating Group entities
  9. GroupMember.Read.All
    • Read the members of all groups
    • Needed for creating group membership relationships and resolving Intune policy assignments to devices
  10. Team.ReadBasic.All
    • Read the names and descriptions of Teams
    • Needed for creating microsoft_teams_team entities
  11. TeamsAppInstallation.ReadForTeam.All
    • Read the apps installed in all Teams
    • Needed for creating microsoft_teams_app_installation entities
  12. AuditLog.Read.All
    • Read audit log data
    • Always requested; on tenants with a Microsoft Entra ID P1 or P2 license, the integration will include signInActivity in the User entity.
  13. Sites.Read.All
    • Read items in all site collections
    • Needed for creating microsoft_365_sharepoint_site, microsoft_365_sharepoint_document_library and microsoft_365_sharepoint_folder entities when the SharePoint ingestion source is enabled. Instances authorized before this permission was added must be re-authorized to grant it.
  14. SecurityEvents.Read.All
    • Read your organization's security events
    • Needed only for the Microsoft Secure Score ingestion source, which creates the microsoft_365_secure_score and microsoft_365_secure_score_control entities. If the permission is missing while that source is enabled, its steps fail with an error that names the permission.

Microsoft Secure Score and Defender for Office 365​

The Microsoft Secure Score ingestion source is disabled by default. Enable it in the instance's ingestion settings after granting SecurityEvents.Read.All.

When enabled, the integration ingests the tenant's latest Microsoft Secure Score and every Secure Score control (recommended action), including the Microsoft Defender for Office 365 controls for Safe Links, Safe Attachments and anti-phishing. Each control records the score the tenant achieves on it (score, maxScore, isFullyImplemented), the state an administrator set on it (controlState), and the Microsoft service that owns it (service). For example, to list the Safe Links and Safe Attachments controls that aren't fully implemented:

FIND microsoft_365_secure_score_control
  WITH (name ~= 'Safe Links' OR name ~= 'Safe Attachments')
  AND isFullyImplemented = false

isFullyImplemented is based on Secure Score points. Microsoft also awards the full points when an administrator marks a control as resolved through a third party or through alternate mitigation, so check controlState as well.

Microsoft Graph doesn't expose the Defender for Office 365 policy objects themselves (Safe Links, Safe Attachments and anti-phishing policies and their settings). Microsoft only makes them available through Exchange Online PowerShell, so this integration doesn't ingest them.

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.