> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365

> Connect ThreatAware to Microsoft 365 to enhance your security posture and threat detection capabilities

## Overview

### Authorization/setup steps

<Info>
  **Connection Method**: API\
  **Setup Time**: 15-20 minutes\
  **Access Required**: Administrator account
</Info>

## Data collected

This integration provides:

* Security event data
* Threat intelligence
* Asset visibility
* Compliance information

## Setup instructions

<Steps>
  <Step title="Log in to your account">
    Access your Microsoft 365 dashboard with administrator credentials.
  </Step>

  <Step title="Create API credentials">
    Generate API credentials or tokens for ThreatAware integration:

    * Navigate to API or integrations settings
    * Create new API key/token
    * Copy credentials securely
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware:

    * Open ThreatAware and navigate to **Settings** > **Integrations**
    * Search for and select **Microsoft 365**
    * Enter the required credentials
    * Click **Connect** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, ThreatAware will begin syncing data.

    * Check that the **Integration Status** shows as **Active**
    * Verify data is appearing in ThreatAware within 30 minutes
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Key" icon="key">
    **Field Name**: Microsoft 365 API Key\
    **Type**: String (encrypted)\
    **Description**: The API key or token generated in Microsoft 365

    <Tip>
      Store this credential securely in your organisation's password manager for future reference.
    </Tip>
  </Accordion>

  <Accordion title="Endpoint URL" icon="server">
    **Field Name**: Microsoft 365 Endpoint\
    **Type**: String\
    **Description**: The API endpoint or URL for your Microsoft 365 instance

    **Format**: Typically your instance URL or API endpoint\
    **Example**: `https://api.microsoft 365.com` or your instance URL
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Microsoft 365 integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 30-60 minutes for the initial data sync
   * Search for known devices or assets in ThreatAware
   * Verify the Microsoft 365 data is present

3. **Test Queries**
   * Create a test query to filter devices with Microsoft 365 data
   * Verify the data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the API key/token is correct and not expired
    * Check if the API credentials have sufficient permissions
    * Ensure the credentials were not modified or rotated
    * Regenerate credentials if needed and update ThreatAware
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the endpoint URL is correct and accessible
    * Check firewall rules allow outbound HTTPS (443) to the endpoint
    * Confirm the Microsoft 365 service is operational
    * Test the URL in a browser to ensure it's reachable
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no data appears

    **Solutions**:

    * Verify there is data available in Microsoft 365 to collect
    * Check API permissions allow access to the required data
    * Contact support for integration logs and debugging
    * Confirm devices/assets exist in your Microsoft 365 account
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Microsoft 365 API Documentation" icon="book" href="https://docs.threataware.com">
    Official Microsoft 365 API documentation
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated API user/token specifically for ThreatAware
  * Document credentials in your organisation's password manager
  * Rotate credentials annually or per your security policy
  * Monitor for authentication failures regularly
</Tip>

<Tip>
  **Security Considerations**

  * Only grant minimum necessary permissions to API credentials
  * Review audit logs in Microsoft 365 periodically to monitor API usage
  * Follow your organisation's least privilege principles
  * Disable credentials immediately if they are compromised
</Tip>