Microsoft Defender for Office 365
Configure the Microsoft Defender for Office 365 integration with RAD Security to ingest email threats and email activity events.
This guide walks you through integrating Microsoft Defender for Office 365 with RAD Security to ingest email threats and email activity events for unified threat detection and investigation.
Defender for Office 365 protects your Microsoft 365 email against phishing, malware, and impersonation. RAD Security authenticates to Microsoft Graph using an Azure AD app registration (OAuth 2.0 client credentials) and pulls email threat detections and email activity events on a scheduled basis to correlate them with your runtime, cloud, and Kubernetes security data.
Read-only integration: RAD Security only reads data from Defender for Office 365. It never writes to, modifies, or deletes anything in your Microsoft 365 tenant.
Prerequisites
Before you begin, ensure you have:
- A Microsoft 365 tenant with Defender for Office 365 enabled
- Permission to register an application in Azure Active Directory (Microsoft Entra ID)
- Permission to grant admin consent for the application's API permissions
- Your Directory (Tenant) ID
- Access to a RAD Security workspace with integration permissions
Understanding Integration Components
Step 1: Register an Application in Azure AD
Sign in to the Azure Portal
Log in to the Azure portal with an account that can register applications and grant admin consent in Microsoft Entra ID (Azure Active Directory).
Create an App Registration
Navigate to Microsoft Entra ID → App registrations → New registration. Give the app a name (for example, RAD Security Email), choose single-tenant, and register it.
Create a Client Secret
On the app, open Certificates & secrets → Client secrets → New client secret. Set an expiry and create it. This is your Client Secret.
Copy the Client Secret value immediately. Azure shows the secret value only once at creation time. Store it securely in a password manager or secrets vault.
Grant Microsoft Graph Permissions
Open API permissions → Add a permission → Microsoft Graph → Application permissions and add the read permissions required to read Defender for Office 365 threats and email activity (for example, the security alerts and email activity report permissions). Then select Grant admin consent for your tenant.
Collect Your Client ID and Tenant ID
On the app's Overview page, copy the Application (client) ID and the Directory (tenant) ID.
Exact portal navigation, permission names, and labels vary across Azure AD / Microsoft Entra versions. See the Microsoft Graph permissions reference and the Defender for Office 365 documentation for current steps and the exact permissions to grant.
Configure in RAD Security
Navigate to your RAD Security workspace and configure the Microsoft Defender for Office 365 integration with the following parameters:
Required Parameters
| Parameter | Description |
|---|---|
| Client ID | Azure AD application (client) ID |
| Client Secret | Azure AD application client secret |
| Directory (Tenant) ID | Microsoft 365 directory/tenant identifier (required) |
| Region | Microsoft cloud environment — optional, defaults to global |
Verify Integration
Check Connection Status
- Navigate to Data Sources > Integrations > Email Security in RAD Security
- Locate your Microsoft Defender for Office 365 integration
- Verify the connection status shows as Connected
Your Defender for Office 365 integration is now configured! RAD Security will ingest email threats and email activity events on a scheduled basis.
What Data is Synced
Use Cases
Threat Investigation Investigate Defender email threats with context from RAD runtime, cloud, and identity detections.
Email Activity Monitoring Track email activity events to understand message flow across your tenant.
Correlated Detection Correlate email threats and activity with RAD runtime and identity signals to cut through the noise.
RADBot Prioritization Leverage RADBot to prioritize Defender email threats by real-world impact.
Troubleshooting
Security Best Practices
Use a Dedicated App Registration Register a dedicated application for the RAD integration rather than reusing an existing one.
Least Privilege Grant only the read permissions required for email threats and activity events.
Rotate Credentials Set a client-secret expiry and rotate it periodically according to your security policy.
Secure Secret Storage Store the Client Secret in a secrets vault. Never commit it to version control.
Additional Resources
Defender for Office 365 Documentation
Official Microsoft Defender for Office 365 documentation
Email Security Overview
Learn about RAD's email security integrations