Microsoft365 Security Integration

AgileBlue can monitor and respond across your Microsoft365 environment by leveraging a single application's API permissions. The full setup instructions and requirements of the various datasets can be found below.

Please note: Auditing must be enabled for your organization in order to ensure data collection. For more information, click here.

Configure Your Azure Application

1. Log in to the Azure Portal using your Global Administrator credentials. (E.g. an account that is marked as Global Administrator.)
2. Navigate to the Microsoft Entra ID under Azure services
3. Select App Registrations in the left-hand menu
4. Click New registration
   1. Name: AgileBlue M365 Security
   2. Supported account types: Accounts in this organizational directory only (Your tenant only - Single tenant)
   3. Redirect URI: No value/not neededConfigure the options for this App Registration as shown below:

Add Required Permissions

Within the application created in the previous section, you will need to add specific permissions sets in order for AgileBlue to monitor various portions of your environment. These permission sets are detailed by integration below:

1. Select View API permissions
2. Click Add a permission
3. Select all permissions detailed below for desired integration points
4. After permissions have been selected, click Add permissions
5. Select Grant admin consent for [your tenant name]

Office365

• Permission Set: Office365 Management APIs (Application Permissions)
  • ActivityFeed.Read
  • ActivityFeed.ReadDlp
• Permission Set: Microsoft Graph (Required for account disablement actions)
  
  • AuditLog.Read.All
  • User.Read (typically added by default)
  • Directory.ReadWrite.All
  • User.EnableDisableAccount.All
  • User.ReadWrite.All
  • User.RevokeSessions.All

M365 Defender

• Permission Set: Microsoft Threat Protection
  
  • Incident.Read.All

Microsoft Defender for Endpoint

• Permission Set: WindowsDefenderATP
  • Alert.Read.All
  • Alert.ReadWrite.All
  • Machine.Isolate
  • Machine.ReadWrite.All

Microsoft Entra ID Entity Analytics

• Permission Set: Microsoft Graph
  • GroupMember.Read.All
  • User.Read.All
  • Device.Read.All

Microsoft Exchange Online Message Trace

• Permission Set: Office365 Exchange Online
  • ReportingWebService.Read.All

Create Client Secret Key & Collect Account Details

1. Select Certificates & secrets from the left-hand menu
2. Once the page loads, click New client secret
3. On the pop out that appears, provide a Description of AgileBlue Collection Service and select your desired timeframe for expiration
   1. Please note this expiration date of the secret value
4. Click Add
   
   CAUTION! Depending on your version of Azure/Office365 and/or your security configurations, you may only have ONE CHANCE to grab this value. Be sure to copy this value and store it somewhere safe immediately.
   
   
5. Copy the Secret Value to a secure location
   1. NOTE: The Secret Value is different than the Secret ID. The required value may have numbers, letters, and special characters. The Secret ID will only include numbers, letters, and hyphens. Please ensure the Secret Value is collected, not the Secret ID.
6. Navigate back to the Overview page and copy the following values:

   1. Application (client) ID

   2. Directory (tenant) ID

Submitting Sensitive Data

The final step is to submit these sensitive details to AgileBlue. Once ready, please email support@agileblue.com and a specialist will send back an encrypted message. You will be able to respond to that message with the following values:

1. 1. Secret Value
   2. Application (client) ID
   3. Directory (tenant) ID
   4. Secret Value expiration date

Need Help?

AgileBlue is always here to support you and ensure you are 100% successful. If there are any issues with the installation or if you have any questions, please reach out to AgileBlue Support.

Email: support@agileblue.com 
Phone: (216) 606-9400🚨