Manual Setup - Microsoft 365 Continuous Scanning

Manually register an Azure app and configure the Mondoo Microsoft 365 integration. Most users should use the automated setup instead; choose the manual path when you need full control or your environment requires it.

PrerequisitesCopy Anchor Link

• Editor or Owner access to the Mondoo space
• An Azure account with an active subscription and one of these Microsoft Entra roles:
  • Global Administrator
  • Application Administrator
  • Cloud Application Administrator
• Access to the Azure CLI (the Azure Cloud Shell already includes it)

Register an Azure app for MondooCopy Anchor Link

Continuous M365 scanning requires a Microsoft Entra ID app registration. The registration creates a service principal that represents Mondoo in your tenant.

The setup is four steps: register the app, grant Microsoft Graph permissions, assign the Global Reader role, and upload an authentication certificate.

Step A: Register the appCopy Anchor Link

1. Log into the Azure portal with one of the required roles above.

2. Open Microsoft Entra ID > App registrations.

   

3. Select + New registration.

   

4. Name the app mondoo-m365, select Accounts in this organizational directory only, and select Register. No redirect URI is needed.

Azure creates the application ID and shows it on the overview page. Keep this page open for the next steps.

Step B: Grant Microsoft Graph API permissionsCopy Anchor Link

1. In the navigation sidebar, select API permissions.

By default, Microsoft grants your new application User.Read permission for Microsoft Graph. It's not required for Mondoo, so you can remove it.

2. Select + Add a permission.

3. From the list of Commonly used Microsoft APIs, select Microsoft Graph.

4. Because Mondoo acts as a service, select Application permissions.

5. Select expand all to see all permissions. Then select the required API permissions:

6. Select the Add permissions button.

7. Grant Mondoo read permissions for SharePoint.

   SharePoint APIs	Type	Description
   Sites.FullControl.All	Application	Have full control of all site collections

8. Select the Add permissions button.

9. Grant Mondoo read permissions for Office 365 Exchange Online. You need to search in APIs my organization uses.

   Office 365 Exchange Online	Type	Description
   Exchange.ManageAsApp	Application	Run Exchange Online commands as if Mondoo was an administrator account

10. Select the Add permissions button.

11. Grant Mondoo read permissions for Microsoft Exchange Online Protection. You need to search in APIs my organization uses. This API is separate from Office 365 Exchange Online, and Mondoo needs both.

    Microsoft Exchange Online Protection	Type	Description
    Exchange.ManageAsApp	Application	Run Security & Compliance PowerShell cmdlets, such as reading DLP policies

12. Select the Add permissions button.

13. To complete the process, select Grant admin consent for (your tenant name) and select the Yes button to confirm.

Step C: Assign the Global Reader roleCopy Anchor Link

1. In the Entra ID portal, go to Identity (Roles & admins).

2. Search for Global Reader and select the role name (not the checkbox). The Assignments page opens.

3. Select + Add assignments, find the mondoo-m365 app, and assign it the Global Reader role.

4. Return to the Assignments page, select Refresh, and confirm the role is assigned.

Step D: Create and upload the authentication certificateCopy Anchor Link

Mondoo authenticates with a PEM certificate. You upload the certificate only to Azure, and the certificate plus private key to Mondoo. The PEM file you upload to Mondoo must use this format and order, with no password protection:

-----BEGIN PRIVATE KEY-----
key goes here
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
certificate goes here
-----END CERTIFICATE-----

openssl req -newkey rsa:4096 -x509 -sha512 -days 365 -nodes -out certificate.pem -keyout privatekey.key

cat privatekey.key certificate.pem > certificate.combo.pem

Upload the certificate (only) to Azure:

1. From the Azure portal home, go to Microsoft Entra ID > App registrations > your app.

2. In the sidebar, select Certificates & secrets.

3. Select Certificates > Upload certificate.

4. Select the PEM file containing only the certificate (not the private key), enter a description such as Mondoo certificate, and select Add.

   Be sure to upload the file with only the certificate. The combined key-and-certificate file is for Mondoo, not Azure.

Add the Microsoft 365 integration in MondooCopy Anchor Link

You need these values from the Azure app registration you created:

• Application (client) ID
• Directory (tenant) ID
• The combined PEM file (private key + certificate)

In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations. In the top right, select INSTALL. On the Install Integration page, find the integration you want by browsing a category or searching by name:

1. Under SaaS Security, select Microsoft 365, then select the Manual Setup tab.

   

2. In Choose an integration name, enter a name that identifies the tenant.

3. Under Choose how to authenticate, select Upload a certificate. If your space already holds a credential for this app registration, you can select Use an existing credential instead and skip to step 6. To learn more, read Manage Integration Credentials.

4. Paste the Directory (tenant) ID and Application (client) ID in their respective boxes.

5. Under Provide your certificate and private key, select UPLOAD PEM FILE and choose the combined PEM file (private key plus certificate).

6. (Optional) Under Enable security policies (optional), enable the policies you want Mondoo to score your Microsoft 365 tenant against.

7. (Optional) Under Set Annotations (optional), select + ADD ANNOTATION to add key-value pairs that Mondoo applies to every asset this integration discovers. To learn more, read Annotate assets.

8. Select START SCANNING.

Renew the application certificateCopy Anchor Link

The certificate has a 1-year default lifetime. When it expires, the integration stops working.

1. In the Azure portal, navigate to the app registration you created and copy the application ID.

2. In Azure Cloud Shell, run:

   Copy Text

   az ad app credential reset --id XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXX --create-cert

3. Download the new certificate from Cloud Shell's Manage files button.

4. In the Mondoo App, navigate to Integrations > Microsoft 365 > your M365 integration and select the edit (pencil) icon.

5. Under Certificate (optional update), select UPLOAD NEW CERTIFICATE FILE and choose the new certificate file, or paste the certificate PEM into the box.

   

6. Select SAVE CHANGES.

Next stepsCopy Anchor Link

• Test or troubleshoot the integration
• Integrate other cloud platforms