IRONCLADHELP CENTERBack to Portal
All docs

Connecting Microsoft 365

Overview

Connecting Microsoft 365 lets Ironclad pull in Azure AD, Exchange, SharePoint, and DLP audit activity from your tenant so it can be monitored and alerted on alongside your other security data.

You don't need to create anything in Azure yourself — Decian maintains a single pre-registered application. All you need to do is tell the portal your Tenant ID and grant that application consent to read your audit logs.

Before you start: You'll need your Microsoft 365 Tenant ID (also called Directory ID — found in the Azure Portal under Microsoft Entra ID > Overview), and you'll need to complete the consent step as a Global Administrator of your Microsoft 365 organization.

Step 1: Open Integrations

  1. Log in to the Ironclad portal.
  2. Make sure the correct customer is selected in the scope bar at the top.
  3. In the left sidebar, under Administration, click Integrations.

Find the Microsoft 365 card.

Step 2: Enter your Tenant ID

  1. In the Microsoft 365 card, enter your Tenant ID in the field of the same name.
  2. Check the Enabled checkbox.
  3. Click Save. You'll see a brief Saved confirmation.

Step 3: Grant admin consent

Once you've entered a Tenant ID, a Next steps panel appears on the card with a generated consent link and three steps:

  1. Click link below — click the admin consent link the portal generated for you.
  2. Sign in with an Administrator of the Org — you must sign in as a Global Administrator; a non-admin account can't grant this consent.
  3. Allow full permissions — review and accept the permissions Microsoft's consent screen shows you.

If the Tenant ID field is blank, the panel will just show a hint to enter a Tenant ID first — the consent link is generated automatically from whatever you type in, so make sure it's saved and correct before clicking it.

Step 4: Confirm it's working

After consent is granted, Ironclad begins pulling Microsoft 365 audit activity on a regular interval. It can take a little while for the first events to appear — check your Ironclad SIEM dashboard for Microsoft 365 / Azure AD / Exchange / SharePoint events to confirm data is flowing.

Troubleshooting

  • Consent link doesn't work / errors out: confirm you're signed in as a Global Administrator, and that the Tenant ID you entered in the portal exactly matches your organization's actual Tenant ID.
  • No events after consent was granted: double-check the Microsoft 365 card shows Enabled and was saved, and give it some time — audit data is pulled periodically, not instantly.
  • Wrong tenant connected: update the Tenant ID field, save, and re-run the consent flow for the correct tenant.