Microsoft 365 (new)

Use Microsoft 365 data for Cortex Cloud.

Secure sensitive data, monitor configurations, and track identity risks across your Microsoft 365 environment, including OneDrive, SharePoint, Teams, and Entra ID.

This connector includes the following capabilities and sub-capabilities (if applicable):

• Automation and Remediation: Run automated workflows and remediation actions across Microsoft 365 services using Microsoft Graph. This capability is available with any active Cortex AgentiX, Cortex Cloud Runtime Security, Cortex XSIAM, Cortex XDR, or Cortex Cloud license.
• Data Security: Scan and protect data across the selected services. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
• Identity Posture: Maintain visibility and control over Microsoft Entra ID identities, including users, groups, roles, and granular permissions. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
• Security Posture: Detect, monitor and alert on security settings across the selected services. This capability is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

  • saas-posture-config-remediation: Help remediate the misconfigured security settings across the selected services. This connector is available with any active Cortex XSIAM or Cortex Cloud Posture Security license.

To configure this connector, follow these steps:

Prerequisite

1. Global Administrator access to the Azure portal

Sign in to the Microsoft Azure portal as a Global Administrator. Use the Create a Microsoft Entra ID page to obtain the following values:

• Tenant ID: Directory ID for your Microsoft 365 tenant.
• Client ID: Application ID generated during app registration.
• Client Secret: Client secret generated for the registered application.

2. Configure the Office 365

Before configuring Microsoft 365, configure the Office 365 to collect the Microsoft 365 Management Activity logs required for SharePoint Online and OneDrive scanning.

For detailed configuration steps, see Configure the Microsoft Office 365.

Note

This prerequisite is not required when configuring Microsoft Teams.

How to configure the Microsoft 365 connector

Task 1. Select services

1. In Cortex Cloud, navigate to Settings → Data Sources & Integrations.
2. Click + Add new.
3. On the Add Data Sources or Integrations page, search for Microsoft 365 (New), hover over it. The new Microsoft 365 connector has the description: Multi-service security integration for Microsoft 365 including OneDrive, SharePoint, Teams, and Entra ID. Click Add.
4. In the wizard, select the Microsoft 365 services that you want to configure, such as:

   • OneDrive for Business
   • SharePoint Online
   • Microsoft Teams

     For detailed configuration steps for Microsoft Teams connector, see Microsoft Teams.

Note

Select one or more services based on your requirements. You can onboard all three services or select only the services you need.

1. Click Next.
2. Set up your Microsoft 365 instance by following the wizard steps in the following tabs.

Capabilities tab

1. Enter a unique name for the new connector instance.
2. Review the available capabilities and select Data Security to enable scanning and inventory collection across the selected repositories.
3. (Optional) Enable Automation and Remediation if you plan to use automated labelling with Microsoft Purview Information Protection (MIP).

Note

Identity Posture is automatically enabled when Data Security is selected and cannot be disabled during setup. Identity Posture is required for user and group validation and cross-tenant exposure analysis.

1. Click Next.

Connection tab

1. On the Connection page, enter the Tenant ID and click Apply.
2. After the Tenant ID is validated, enter the Client ID and Client Secret in their respective fields.
3. Click Test to validate the connection settings.
4. If the connection is successful, the wizard displays a green Verified status indicator.

Note

If validation fails because of incorrect field values, close the wizard and restart the workflow. The current wizard session cannot be reused after a validation failure.

5. Click Next to proceed.

Summary tab

1. On the Summary page, verify that each selected capability displays a Connected status.
2. If validation succeeds, the wizard displays a Verification Success message.
3. Click Create Instance to create the Microsoft 365 connector.

Task 2. (Optional) Post verification

After onboarding is complete, verify asset discovery and data security findings.

1. Verify discovered assets

1. Go to Inventory > All Assets.
2. Filter the asset list by setting Provider to Microsoft 365.
3. Verify that Cortex discovers the following supported asset types:

   • Microsoft OneDrive: Individual user cloud storage environments provisioned within the Microsoft 365 organization.
   • Microsoft Document Library: Document containers, document sets, and file repositories hosted in OneDrive and SharePoint.
   • Microsoft SharePoint Site: Root and sub-level team sites, communication sites, and site collections that contain collaborative files and permissions.
   • Microsoft Teams Workspace: Mapped to Active Directory (AAD) Groups containing Public, Private, or Shared Channels.
   • Microsoft Personal Workspace: Captures 1-on-1 Direct Messages (DMs) and multi-user Group Chats.

2. Verify policy findings

1. Select a OneDrive or other supported asset to open the details panel.
2. Review the Overview tab for asset health and other details.
3. Go to Findings to review detected security findings, including:

   • Sensitive Content Detections: Sensitive data matches, such as financial data, health records, credentials, API tokens, credit card numbers, and personally identifiable information (PII), detected in files stored in OneDrive and SharePoint or in Microsoft Teams chat messages and conversations.
   • Insecure Sharing and External Exposure: Files and folders exposed through anonymous access links, such as Anyone with the link, organization-wide shared links, or external guest user access in OneDrive and SharePoint. This also includes sensitive information shared in Microsoft Teams chats or conversations with external users or guest users.
   • Misconfigured Permissions and Excessive Exposure: Overly permissive access controls, broken permission inheritance, or unrestricted access to sensitive OneDrive folders, SharePoint sites, and document libraries.

Note

• Any user addition to or removal from a Microsoft Teams group chat may take up to 6 hours to be reflected.
• ACLs for messages sent before a user is added to or removed from a Microsoft Teams group chat are not updated to reflect the membership change.
• After onboarding a connector, Cortex Cloud may take 24 hours to 7 days to fully process the data and generate findings. If you attempt to re-onboard the same connector using the same credentials during this transition period, previously generated findings and other data may temporarily reappear.

Troubleshooting

1. Connector Health Monitoring

If the connector health status shows a Warning or Error, follow the instructions displayed in the Connector Health dialog box in the console. If the issue persists, contact Support for further assistance.

1. Forward Scan / Real-Time Events

   1. Ensure that the ActivityFeed.Read permission is configured for the enterprise application and has been granted admin consent.
   2. Verify that all application permissions specified in the documentation are configured and have been granted admin consent.
   3. Confirm that the log collector was onboarded with the SharePoint Online option selected.
   4. Ensure that the Microsoft Entra application’s client secret or certificate has not expired and that the enterprise application remains authorized.

Exposure Definitions

Microsoft content is classified into four exposure categories: • Internal: Documents that are not shared or are shared only with specific members of the organization. • Organization-Wide: Documents shared with all members of the organization, such as through a “People in your organization” link or tenant-wide permissions. • External: Documents shared with one or more users outside the organization. • Public: Documents with an anonymous sharing link enabled, allowing anyone with the link to access them.