Microsoft 365 Onboarding Guide

Updated 1 month ago by admin

This guide provides the steps you need to follow in order to onboard Microsoft 365 accounts onto the Posture Management service.

This article will guide you through the following steps:

  • Create and configure a Microsoft App Registration for Posture Management
  • Assign read-only permissions to the new App Registration for Posture Management
  • Add the Microsoft 365 application to the Posture Management service
You will need to be an Administrator of the Microsoft 365 account, or have sufficient admin privileges, to perform these steps
  1. Log in to the Azure Portal
  2. Search for App Registrations and open the panel
  3. Click New Registration
  4. In the Name field, enter something to identify the new application, such as "Posture Management"
  5. In the Supported account types section select Accounts in this organizational directory only (Single tenant)
  6. Click Register
  7. From the new app Overview page, make a note of the Application (client) ID and Directory (tenant) ID. These are required in the last step.
  8. From the left navigation menu, select Certificates & Secrets
  9. Click New Client Secret
  10. Enter a name for the secret and select the expiry time to suit your company policy
  11. Click Add
  12. Copy the Value of the new secret from the table and keep it safe. Once you leave this section the secret will not be visible again. You will need the secret in the last step
  13. Click API Permissions on the left
  14. Remove the default User.Read permission and then click Add a permission and then Microsoft Graph and Application Permissions. Add the following one-by-one to the selector:
  • Application.Read.All
  • AuditLog.Read.All
  • Policy.Read.All
  • Reports.Read.All
  • RoleManagement.Read.All
  • User.Read.All
  • UserAuthenticationMethod.Read.All
  • Directory.Read.All
  • Group.Read.All
  • SecurityEvents.Read.All
  • SharePointTenantSettings.Read.All
  1. Click Add Permissions
  2. To allow the use of PowerShell snippets to perform checks, click Add a Permission and then click the APIs my organization uses tab and select the Office 365 Exchange Online option:
  3. Next click Application Permissions and then Add Permissions. Scroll down to the Exchange folder, expand it and make sure Exchange.ManageAsApp is checked.
  4. Click Add Permissions
  5. Now click Grant admin consent for XXX Directory
  6. To activate checks using PowerShell (recommended), the Exchange Administrator role should be assigned to the newly created Posture Management app created in Step 4. Open the Microsoft Entra roles and administrators section and in the Search field enter Exchange Administrator
  7. Click on Exchange Administrator to open the Exchange Administrator Assignments page.
  8. Click the + Add Assignments button.
  9. On the opened Add Assignments page, scroll down and click the No member selected button.
  10. On the Select a member page, in the Search field search for the "Posture Management" app created in Step 4, select it, and click the Select button. Your new "Posture Management" app should appear in the Assignments list

  1. On the Add assignments page, scroll up and open the Setting tab.
  2. On the Setting tab, select Assignment type: Active.  Keep the Permanently assigned checkbox selected.
  3. Then enter justification, e.g., The Censornet Posture Management Service requires this setting for configuration scanning.
  4. Click the Assign button.

  1. Now we can configure the Posture Management service with your new Microsoft 365 application. Log in to the USS Dashboard and navigate to Products -> Posture Management.
  2. The Posture Management dashboard will open in a new tab. From the top ribbon, select Service Integration and then +
  1. Click Microsoft 365
  1. In the Tenant ID field paste in the Directory ID from step 7. In the Client ID field paste in the Application ID from step 7. In the Secret value field paste in the value from step 12
  2. Click Add
  3. Click Scan Now to begin scanning the application immediately, or wait for it to automatically scan on a daily basis
  4. One the first scan has finished you will be able to view the results in the Charts and Activity report tabs

How did we do?