> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Defender for Office 365

> Configure the Microsoft Defender for Office 365 integration with RAD Security to ingest email threats and email activity events.

# Microsoft Defender for Office 365 Integration Setup

This guide walks you through integrating Microsoft Defender for Office 365 with RAD Security to ingest email threats and email activity events for unified threat detection and investigation.

Defender for Office 365 protects your Microsoft 365 email against phishing, malware, and impersonation. RAD Security authenticates to Microsoft Graph using an Azure AD app registration (OAuth 2.0 client credentials) and pulls email threat detections and email activity events on a scheduled basis to correlate them with your runtime, cloud, and Kubernetes security data.

<Info>
  **Read-only integration:** RAD Security only reads data from Defender for Office 365. It never writes to, modifies, or deletes anything in your Microsoft 365 tenant.
</Info>

## Prerequisites

Before you begin, ensure you have:

<Check>
  * A Microsoft 365 tenant with Defender for Office 365 enabled
  * Permission to register an application in Azure Active Directory (Microsoft Entra ID)
  * Permission to grant admin consent for the application's API permissions
  * Your Directory (Tenant) ID
  * Access to a RAD Security workspace with integration permissions
</Check>

## Understanding Integration Components

<AccordionGroup>
  <Accordion title="Azure AD App (OAuth) Credentials" icon="key">
    RAD Security authenticates to Microsoft Graph using the OAuth 2.0 client-credentials grant. You register an application in Azure AD and provide its **Client ID** and **Client Secret**. RAD exchanges them for short-lived access tokens automatically.
  </Accordion>

  <Accordion title="Directory (Tenant) ID" icon="building">
    The **Directory (Tenant) ID** identifies your Microsoft 365 tenant and is used in the OAuth token request. You can find it on the application's overview page or in your Azure AD tenant properties. This field is **required**.
  </Accordion>

  <Accordion title="Region" icon="globe">
    The optional **Region** selects the Microsoft cloud environment. Leave it at the default (**global**) for standard commercial tenants. Set it only if your tenant runs in a sovereign or national cloud.
  </Accordion>

  <Accordion title="Scheduled Polling" icon="clock">
    RAD Security ingests Defender for Office 365 data via scheduled polling. Webhooks are **not** used — data arrives on RAD's polling cadence rather than being pushed by Microsoft.
  </Accordion>
</AccordionGroup>

***

## Step 1: Register an Application in Azure AD

<Steps>
  <Step title="Sign in to the Azure Portal">
    Log in to the [Azure portal](https://portal.azure.com) with an account that can register applications and grant admin consent in Microsoft Entra ID (Azure Active Directory).
  </Step>

  <Step title="Create an App Registration">
    Navigate to **Microsoft Entra ID → App registrations → New registration**. Give the app a name (for example, `RAD Security Email`), choose single-tenant, and register it.
  </Step>

  <Step title="Create a Client Secret">
    On the app, open **Certificates & secrets → Client secrets → New client secret**. Set an expiry and create it. This is your **Client Secret**.

    <Warning>
      Copy the **Client Secret** value immediately. Azure shows the secret value only once at creation time. Store it securely in a password manager or secrets vault.
    </Warning>
  </Step>

  <Step title="Grant Microsoft Graph Permissions">
    Open **API permissions → Add a permission → Microsoft Graph → Application permissions** and add the read permissions required to read Defender for Office 365 threats and email activity (for example, the security alerts and email activity report permissions). Then select **Grant admin consent** for your tenant.
  </Step>

  <Step title="Collect Your Client ID and Tenant ID">
    On the app's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**.
  </Step>
</Steps>

<Note>
  Exact portal navigation, permission names, and labels vary across Azure AD / Microsoft Entra versions. See the [Microsoft Graph permissions reference](https://learn.microsoft.com/en-us/graph/permissions-reference) and the [Defender for Office 365 documentation](https://learn.microsoft.com/en-us/defender-office-365/) for current steps and the exact permissions to grant.
</Note>

***

## Configure in RAD Security

Navigate to your RAD Security workspace and configure the Microsoft Defender for Office 365 integration with the following parameters:

### Required Parameters

| Parameter                 | Description                                                    |
| ------------------------- | -------------------------------------------------------------- |
| **Client ID**             | Azure AD application (client) ID                               |
| **Client Secret**         | Azure AD application client secret                             |
| **Directory (Tenant) ID** | Microsoft 365 directory/tenant identifier (required)           |
| **Region**                | Microsoft cloud environment — optional, defaults to **global** |

***

## Verify Integration

<Steps>
  <Step title="Check Connection Status">
    1. Navigate to **Data Sources > Integrations > Email Security** in RAD Security
    2. Locate your Microsoft Defender for Office 365 integration
    3. Verify the connection status shows as **Connected**
  </Step>
</Steps>

<Check>
  Your Defender for Office 365 integration is now configured! RAD Security will ingest email threats and email activity events on a scheduled basis.
</Check>

## What Data is Synced

<AccordionGroup>
  <Accordion title="Email Threats" icon="radar">
    Email threat detections — phishing, malware, impersonation — mapped to OCSF Detection Finding, stored as security findings, and correlated with runtime, cloud, and identity signals.
  </Accordion>

  <Accordion title="Email Activity Events" icon="wave-pulse">
    Email message events across your tenant, mapped to OCSF Email Activity and stored alongside RAD's other activity feeds.
  </Accordion>
</AccordionGroup>

## Use Cases

<CardGroup cols={2}>
  <Card title="Threat Investigation" icon="magnifying-glass">
    Investigate Defender email threats with context from RAD runtime, cloud, and identity detections.
  </Card>

  <Card title="Email Activity Monitoring" icon="wave-pulse">
    Track email activity events to understand message flow across your tenant.
  </Card>

  <Card title="Correlated Detection" icon="diagram-project">
    Correlate email threats and activity with RAD runtime and identity signals to cut through the noise.
  </Card>

  <Card title="RADBot Prioritization" icon="robot">
    Leverage RADBot to prioritize Defender email threats by real-world impact.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="triangle-exclamation">
    **Possible causes:**

    * Incorrect Client ID, Client Secret, or Directory (Tenant) ID
    * The client secret expired or was deleted in Azure AD

    **Solution:**

    * Verify the Client ID, Client Secret, and Tenant ID are copied correctly (no extra spaces)
    * Confirm the client secret is still valid under **Certificates & secrets**
    * Generate a new client secret in Azure AD and update it in RAD Security if needed
  </Accordion>

  <Accordion title="Insufficient Permissions" icon="lock">
    **Possible causes:**

    * Required Microsoft Graph application permissions were not added
    * Admin consent was not granted for the tenant

    **Solution:**

    * Confirm the required read permissions are present under **API permissions**
    * Select **Grant admin consent** and re-check the permission status shows consent granted
  </Accordion>

  <Accordion title="Wrong Region" icon="globe">
    **Possible causes:**

    * The selected Region does not match your tenant's Microsoft cloud

    **Solution:**

    * Leave Region at **global** for standard commercial tenants
    * Set the matching sovereign/national cloud only if your tenant runs in one, then reconnect
  </Accordion>

  <Accordion title="Empty Results" icon="inbox">
    **Possible causes:**

    * No email threats or activity events in scope for the configured tenant

    **Solution:**

    * Confirm Defender for Office 365 is generating detections in the Microsoft 365 Defender portal
    * Verify the Tenant ID matches the tenant where Defender for Office 365 is active
  </Accordion>
</AccordionGroup>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use a Dedicated App Registration" icon="user-gear">
    Register a dedicated application for the RAD integration rather than reusing an existing one.
  </Card>

  <Card title="Least Privilege" icon="shield-halved">
    Grant only the read permissions required for email threats and activity events.
  </Card>

  <Card title="Rotate Credentials" icon="rotate">
    Set a client-secret expiry and rotate it periodically according to your security policy.
  </Card>

  <Card title="Secure Secret Storage" icon="vault">
    Store the Client Secret in a secrets vault. Never commit it to version control.
  </Card>
</CardGroup>

## Additional Resources

<CardGroup cols={2}>
  <Card title="Defender for Office 365 Documentation" icon="book" href="https://learn.microsoft.com/en-us/defender-office-365/">
    Official Microsoft Defender for Office 365 documentation
  </Card>

  <Card title="Email Security Overview" icon="envelope-open-text" href="/rad-security/integrations/email-security/overview">
    Learn about RAD's email security integrations
  </Card>
</CardGroup>

## Next Steps

<CardGroup cols={2}>
  <Card title="Mimecast Setup" icon="envelope" href="/rad-security/integrations/email-security/mimecast-setup">
    Connect Mimecast Cloud Gateway for email threats
  </Card>

  <Card title="Email Security Integrations" icon="envelope-open-text" href="/rad-security/integrations/email-security/overview">
    Explore other email security integration options
  </Card>

  <Card title="RADBot" icon="robot" href="/rad-security/getting-started/radbot">
    Learn how RADBot helps prioritize findings
  </Card>
</CardGroup>