How to get started with the Microsoft 365 data source.
Notice
This feature is included with a Cortex XSIAM Premium license. It is also included with any other Cortex XSIAM license that has the Cloud Posture Security or Cloud Runtime Security add-on.
Overview
You can add Microsoft 365 as a third-party data source in Cortex Cloud Data Security.
Danger
You have generated a Globally Unique Identifier (GUID), also known as a Universally Unique Identifier (UUID). You will need this ID for the tenant you want to use for the Microsoft 365 instance.
In order to use Microsoft 365, you must be registered with Microsoft Azure.
Configuration
Navigate to → .
On the Data Sources & Integrations page, click + Add New.
On the Add Data Sources or Integrations page, search for Microsoft 365, then hover over it and click Add.
On the Microsoft 365 integration instance settings page, do the following:
In the Display Name field, enter a name for your Microsoft 365 integration instance.
In the Tenant ID field, enter a tenant ID.
In the Region list, select a region.
Click Next.
Authorization
On the Microsoft 365 Instance screen, if you are an administrator, click the click to authorize link.
If you do not have administrator permissions, follow the instructions on screen and click Close.
The Microsoft 365 instance should now appear on the Data Sources screen under 3rd Party Data Sources.