> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365-email/ingest-logs-and-data-from-microsoft-365.md).

# Ingest logs and data from Microsoft 365

The Microsoft 365 email collector fetches email metadata through Microsoft Graph API, using an authorized app. A compliance mailbox is not required.

{% hint style="info" %}
**License**

**Email content visibility and licensing**: Email subjects and bodies are stored in an encrypted format to ensure data privacy. To view this content or generate alerts for it, an Email Security module license is required.

* **Without the license**: Sensitive email content (subject, body, and attachments) remains encrypted and is not accessible for viewing or threat hunting.
* **With the license**: When the module detects a suspicious or malicious email, it automatically creates an issue and decrypts the subject, body, and attachments. This decrypted content is then made available as an artifact within the issue for investigation.
  {% endhint %}

{% hint style="info" %}
**Note:** For other logs from Microsoft Office 365, use the Office 365 data collector. For more information, see [Ingest logs from Microsoft Office 365](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365/ingest-logs-from-microsoft-office-365.md).
{% endhint %}

{% hint style="info" %}
**Prerequisite**

* A user account with the Microsoft Azure Account Administrator role is required to set up a new Microsoft 365 email collector.
* The following Microsoft Graph API permissions are required:
  * Mailbox access (read-write)
    * Read and write mail in all mailboxes
    * Read contacts in all mailboxes
    * Read all user mailbox settings
  * User information, groups, and directory data (read-only)
    * Read directory data
    * Read all groups
    * Read all users' full profiles
      {% endhint %}

### Scoping

You can narrow down the scope of ingested mailboxes by:

* Microsoft 365 Group
* Distribution List
* Mail-enabled Security Group
* Mail-enabled Users

### Datasets

The Microsoft 365 collector provides a comprehensive data stream by ingesting information into the following nine datasets. These are categorized by their default availability and licensing requirements:

Standard datasets

These datasets are collected as part of the standard Microsoft 365 connector configuration:

* `msft_o365_emails_raw`: Metadata and logs for email traffic.
* `msft_o365_users_raw`: Information regarding user accounts and identities.
* `msft_o365_groups_raw`: Data related to Office 365 groups and distribution lists.
* `msft_o365_devices_raw`: Details on devices registered within the M365 environment.
* `msft_o365_mailboxes_raw`: Configuration and status logs for individual mailboxes.
* `msft_o365_rules_raw`: Logs for mail flow, transport, and inbox rules.
* `msft_o365_contacts_raw`: Organizational and user-defined contact information.

Licensed security datasets

The following datasets are specialized and require the Email Security module license to be active:

* `msft_o365_protected_emails_raw` - requires the Email Security module license.
* `o365_email_threat_submission_policies` - requires the Email Security module license.

### Data encryption and privacy

Cortex XSIAM prioritizes data privacy while maintaining security visibility. The following rules apply to ingested email data:

* **Storage and encryption**: Cortex XSIAM stores email metadata as plain text, but the email subject and body are always encrypted.
* **Retention policy**: The email body is temporarily saved for 48 hours and is then automatically deleted.
* **Automated analysis**: Analytical detectors automatically scan both raw metadata and encrypted content to identify threats.
* **Decryption for investigation**: When an issue is created for a malicious email, the raw email (including decrypted subject and body) is attached to the issue as an artifact for review.
* **Threat hunting constraints**: You cannot perform threat hunting based on the email subject or body content. Only metadata, such as Date, From, or To, is available for Cortex Query Language(XQL) threat hunting queries.

### How to configure Microsoft 365 collection

1. Navigate to the data source.
   * Select **Settings → Data Sources & Integrations**, click **+ Add New**, search for **Microsoft 365**, then hover over it and click **Add**.
2. Perform permissions verification.
   * In the wizard, review the required items on the **Permissions** page, and then click **Next**.
3. Authorize.
   * Click **OK** to confirm you understand that API authorization consent is required.
4. Perform Microsoft sign-in.
   1. Select the Microsoft account for collection.
   2. Click **Next**.
   3. Enter your credentials for the Microsoft account and click **Sign in**.
   4. If you are asked to perform authentication using your organization's authentication tools, do so.
5. Accept permissions.
   * Review the list of of permissions requested by the collector and click **Accept**.
6. Define the scope.
   1. On the **Scope** page, select one of the following:
      * **Entire organization**: Emails will be collected from all mailboxes in your organization.
      * **Specific groups**: Enter the email addresses of group names, such as Microsoft 365 Groups, Mail-enabled Security Groups, Distribution Lists, or Mail-enabled Users.
   2. Click **Next**.
7. Finalize the details and create the integration instance.
   1. On the **Details** page, enter a meaningful instance name, and click **Next**.
   2. On the **Summary** page, check your configurations, and then click **Create**.

#### Verification

Once the configuration is complete, a green check mark will appear below the Microsoft 365 configuration, and the console will display the amount of data received. You can now run queries against the datasets listed above.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/vendor-specific-data-sources-and-connectors/microsoft/microsoft-office-365-email/ingest-logs-and-data-from-microsoft-365.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.