# Set Up Microsoft 365/Cloud Monitor

GuardWare INSIGHT integrates directly with Microsoft 365 cloud services, specifically Exchange Online and SharePoint Online, to monitor and analyse cloud-based activities. To enable this integration, several configurations must be completed in the Azure portal. Because the registration process relies on your organisation’s Azure configuration and credentials, it must be performed using the company’s Azure portal account by an authorised administrator.

The configurations involve registering an application in Azure, creating a certificate, and granting the required permissions and roles, which are explained below. These steps allow GuardWare INSIGHT to securely access monitoring data from Exchange and SharePoint. Once the configuration is complete, the generated information, such as application ID, certificates, and domain details, must be sent to GuardWare Support to complete the setup. See [Information to Be Sent to GuardWare](#information-to-be-sent-to-guardware) for the full list.

<table data-header-hidden><thead><tr><th width="262"></th><th></th></tr></thead><tbody><tr><td><strong>Requirement</strong></td><td><strong>Description</strong></td></tr><tr><td><strong>Application (Client) ID</strong></td><td>Identifies the GuardWare M365 Monitor Azure application. This ID is generated automatically when registering the application in Azure.</td></tr><tr><td><strong>Directory (Tenant) ID</strong></td><td>Identifies your organisation in Azure for email monitoring. This ID is also generated during Azure application registration.</td></tr><tr><td><strong>Organisation Primary Domain</strong></td><td>Identifies your organisation for SharePoint monitoring. This is your organisation’s primary <strong>.onmicrosoft.com</strong> domain.</td></tr><tr><td><strong>Application Permissions</strong></td><td><p>The following permissions are required in Azure for GuardWare Cloud Monitor to access Microsoft 365 data:</p><ul><li><code>Group.Read.All</code></li><li><code>GroupMember.Read.All</code></li><li><code>User.Read.All</code></li><li><code>Mail.Read</code></li><li><code>Mail.ReadBasic.All</code></li><li><code>Exchange.ManageAsApp</code></li><li><code>ActivityFeed.Read</code></li><li><code>ServiceHealth.Read</code></li></ul></td></tr><tr><td><strong>M365 Security Group</strong></td><td>Created in the Microsoft 365 Admin Center, this group defines the users whose emails are to be monitored.</td></tr><tr><td><strong>On-Premises Domain Name</strong></td><td>Maps GuardWare INSIGHT endpoint users to their corresponding Microsoft 365 email addresses within the GuardWare Server.</td></tr><tr><td><strong>Certificate and Password</strong></td><td>Used for secure communication between Microsoft 365 and GuardWare Cloud Monitor. The certificate is generated locally using Microsoft PowerShell.</td></tr></tbody></table>

### Register an Application on Azure Portal

To enable GuardWare INSIGHT to access and monitor Microsoft 365 data, you must first register a new application in the Azure portal. This application acts as a secure bridge between Microsoft 365 and GuardWare, allowing authorised access through assigned permissions and roles.

To register an application on the Azure Portal:

1. Go to the [Azure Portal](https://portal.azure.com/auth/login/) and sign in with your Microsoft 365 administrator account.
2. Navigate to **Microsoft Entra ID.**

   <div align="left"><img src="/files/770c010469725eb7f55250efdffa7c0a236472e2" alt="" width="563"></div>
3. Click **+Add**, and select **App registration**.

<div align="left"><img src="/files/dfc11d3db14de54e8e4ed5bb66d2badbc9264f6a" alt="" width="563"></div>

4. Configure:
   1. **Name:** Enter a user-facing descriptive display name (e.g., `GuardWare M365 Monitor`).
   2. **Supported account types:** Select **Accounts in this organizational directory only (Single tenant)**.
   3. **Redirect URI:** Leave empty for service-to-service authentication.

      <div align="left"><img src="/files/62f2fb8ae1a8e2b2eebe037e03636289540ed37d" alt="" width="563"></div>
5. Click **Register**.

After registration is complete, you will get the **Application (client) ID** and **Directory (tenant) ID** in the Overview page. Copy and store them in a secure place. You’ll need it later to complete the setup.

![](/files/cf8972d478a1f9fe2e8074b0fc3e25a24df69acb)

### Create a Self-Signed Certificate

You can create a self-signed certificate using Windows PowerShell with the following script to establish a secure connection between GuardWare INSIGHT and Microsoft 365. The certificate remains valid for three years.

Before running the script:

* Replace `<companydomain>` and `<password>` with your own values.
* The company domain is used as a descriptor and does not need to be accurate.
* Copy and store the password securely. You’ll need it later to complete the setup.
* The script generates two files:
  * A **.cer file**: Used to register the certificate with the Azure application.
  * A **.pfx file**: Used by `GWCloudMonitor.exe` to identify itself to Azure.
* Both `.cer` and `.pfx` are saved in `C:\Temp` (You can change the path as needed).

**PowerShell Script**

{% code overflow="wrap" %}

```powershell
# Create certificate
$mycert = New-SelfSignedCertificate -DnsName "<companydomain>" -CertStoreLocation "cert:\CurrentUser\My" -NotAfter (Get-Date).AddYears(3) -KeySpec KeyExchange

# Export certificate to .pfx file
$mycert | Export-PfxCertificate -FilePath mycert.pfx -Password (ConvertTo-SecureString -String "<password>" -AsPlainText -Force)

# Export certificate to .cer file
$mycert | Export-Certificate -FilePath mycert.cer
```

{% endcode %}

### Register the Self-Signed Certificate

The next step is to upload the certificate to the Azure application.

1. In the left navigation menu of the GuardWare M365 Monitor application page, click **Certificates & secrets**.

<div align="left"><img src="/files/aa113c34a8984486627d61e689fe4c9caacd037a" alt="" width="563"></div>

2. Under **Certificates,** click **Upload certificate**.

<div align="left"><img src="/files/51e2fc88f4a88a396ebc1b5079f687a8cd2adf6c" alt="" width="563"></div>

3. Select the `mycert.cer` file to upload and enter a description.
4. Click **Add**.

   <div align="left"><img src="/files/1aa758ca1ae21636d69110916bc4fa665e68d3c4" alt="" width="375"></div>

Once successfully uploaded, the certificate will appear in the list of certificates associated with the application.

### Grant Permissions to the Application

Microsoft Graph API permissions and Exchange Online API permissions are needed for GuardWare INSIGHT to access user, group, and mailbox information for monitoring and analysis.

#### **Grant Microsoft Graph API Permissions**

To grant Microsoft Graph API Permissions:

1. In the left navigation menu of the **GuardWare M365 Monitor** page, click **API Permissions**.

<div align="left"><img src="/files/f57e98e26c9e266846736a2fe086fd46261b8a0e" alt="" width="188"></div>

1. Click **+ Add a permission**. The *Request API permissions* panel opens on the right-hand side

<div align="left"><img src="/files/13bf51a708b1850a66094295b5a7131830e0a659" alt="" width="563"></div>

3. Under the **Microsoft APIs** tab, click **Microsoft Graph**.

<div align="left"><img src="/files/1c0e38ce95a8b4d1583963e7d984029a23e2b7ae" alt="" width="375"></div>

4. Click **Application permissions**.

<div align="left"><img src="/files/57a2a78ffc5cbda6f13d3107e2ebef47db12d4e5" alt="" width="375"></div>

5. From the list of permissions, expand the categories or search and select the following permissions:
   1. `Group.Read.All`
   2. `GroupMember.Read.All`
   3. `User.Read.All`
   4. `Mail.Read`
   5. `Mail.ReadBasic.All`
6. Click **Add permissions**.
7. Once added, click **Grant admin consent for \<your organisation>** to approve the permissions. You must be signed in to the Azure Portal using an administrator account to grant admin consent.

<div align="left"><img src="/files/a42dfadc662043fcdb61e77f2b36815962500b98" alt="" width="563"></div>

#### Grant Exchange Online API Permission

To grant Exchange Online API permission:

1. In the **API Permissions** page, click **+ Add a permission**. The *Request API permissions* panel opens on the right-hand side.

<div align="left"><figure><img src="/files/LjRRcjduJ40ObwQbjrRY" alt="" width="563"><figcaption></figcaption></figure></div>

2. In the *Request API permissions* panel, select the **APIs my organisation uses** tab.
3. Search for **Office 365 Exchange Online**.
4. Click **Office 365 Exchange Online** from the search results to view its available permissions.

<div align="left"><img src="/files/847ef0708152b621c6b8c396b01f0331aa5a25d4" alt="" width="563"></div>

5. Under **Exchange**, select the `Exchange.ManageAsApp` permission.

<div align="left"><img src="/files/021520e181e768142d01c126fd8884ef7a26ce0d" alt="" width="563"></div>

6. Click **Add permissions** to complete the process.

#### Grant Office 365 Management API Permissions (Required for SharePoint)

SharePoint log collection requires permissions from the **Office 365 Management APIs**.

To grant these permissions:

1. In the left navigation menu of the **GuardWare M365 Monitor** page, click **API Permissions**.
2. Click **+ Add a permission**. The *Request API permissions* panel opens on the right-hand side.

<div align="left"><figure><img src="/files/r5e3Ol1XjQhUg52WbtRW" alt="" width="563"><figcaption></figcaption></figure></div>

3. Under the **Microsoft APIs** tab, click **Office 365 Management APIs**.

<div align="left"><figure><img src="/files/TWaO2TBlilEV3vyU4ax4" alt="" width="375"><figcaption></figcaption></figure></div>

4. In *Request API permissions*, click **Application permissions**.

<div align="left"><figure><img src="/files/npDufZECdUnFWdYjb5hB" alt="" width="328"><figcaption></figcaption></figure></div>

5. From the list of available permissions, select the following:
   1. `ActivityFeed.Read`
   2. `ServiceHealth.Read`
6. Click **Add permissions**.

<div align="left"><figure><img src="/files/g8JfdCYp73S2AUg9hbBz" alt="" width="480"><figcaption></figcaption></figure></div>

7. Once added, click **Grant admin consent for \<your organisation>** to approve the permissions. You must be signed in to the Azure Portal using an administrator account to grant admin consent.

<div align="left"><figure><img src="/files/SPyiwHUQBWtqkCeqjoWJ" alt="" width="563"><figcaption></figcaption></figure></div>

### Assign Role to the Application

After configuring permissions, assign the necessary **Microsoft Entra roles** to the GuardWare M365 Monitor application. To ensure GuardWare INSIGHT can access the required Microsoft 365 data, specific administrative roles must be assigned to the registered application.

To assign roles to the application:

1. In the **Azure portal**, navigate to **Microsoft Entra ID** and click **Roles and administrators or** use the search bar to find and select **Microsoft Entra Roles and Administrators**.
2. To assign the Exchange Administrator Role:
   1. On the **All roles** page, search for **Exchange Administrator** and click the role name.\
      **Do not select the checkbox** next to the role. If the role is selected, you will not be able to add assignments.

      <div align="left"><img src="/files/JqLuKoay8FeO2NwUpd83" alt=""></div>
   2. Click **Add assignments**.
   3. In the search field, enter the name of the application created earlier (for example, *GuardWare M365 Monitor*).
   4. Select the application and click **Add** to assign the role.
3. To assign the Compliance Administrator Role:
   1. Return to the **All Roles** page. Search and click **Compliance Administrator**.\
      **Do not select the checkbox** next to the role. If the role is selected, you will not be able to add assignments.
   2. Click **Add assignments**.
   3. Search for the same application name (for example, *GuardWare M365 Monitor*).
   4. Select the application and click **Add** to complete the role assignment.

### Create a Security Group of Emails to Be Monitored

A dedicated security group helps define which user mailboxes will be monitored by GuardWare INSIGHT.

To create a security group that includes the email accounts to be monitored:

1. Log in to the [Microsoft 365 admin center](https://admin.microsoft.com/) as an administrator.
2. Navigate to **Teams & Groups > Active Teams & Groups**, and select the **Security groups** tab.
3. Click **+ Add a security group**.

![](/files/56f36bf35d9a23df775285add17ac583a471000a)

4. Enter the **Name** and **Description** for the security group and click **Next**.
5. Click **Create group**, and once the group is created, click **Close**. The new security group may take a few seconds to appear in the list.
6. Click the newly created security group to open it.
7. Click **Members > View all and manage members > Add members**.
8. Add the users (email accounts) you want to include in the monitored group.

### Getting the Organisation’s Primary Domain

The organisation’s primary domain is required for integration with GuardWare INSIGHT.

To find your organisation’s primary domain in Azure:

1. Log in to the [**Azure Portal**](https://portal.azure.com/).
2. Search for **Domain names**, and select **Domain Names** from the results.

<div align="left"><img src="/files/87f4af680f08aeb0872fa0d6aa1c985a1d765899" alt="" width="563"></div>

3. Locate the domain that ends with `.onmicrosoft.com`.

<div align="left"><img src="/files/775085ccec277a5a6bf9bfaf0ab332e6fdb9de56" alt="" width="563"></div>

4. Copy the domain name; this is your organisation’s **primary domain**.

### Information to Be Sent to GuardWare

After completing all configuration steps, send the following details to **GuardWare Support** to complete the Microsoft 365 setup:

1. **Application (Client) ID**
2. **Directory (Tenant) ID**
3. **On-Premises Domain Name**
4. **Certificate (.pfx file)** and its **Password**
5. **Monitored Security Group**
6. **Organisation Primary Domain**

{% hint style="info" %}
Ensure that the certificate password is shared securely and only with authorised GuardWare representatives.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.guardware.com/insight/guardware-insight/getting-started/set-up-microsoft-365-cloud-monitor.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.