---
title: Connecting the Microsoft Integration Suite
description: Connect each of your Microsoft security tools to Prelude based on the instructions included for permissions and API generation.
---

[Skip to content](https://support.preludesecurity.com/docs/microsoft-all#main-content)

English

Show submenu for translations

[Contact support](https://support.preludesecurity.com/kb-tickets/new?hsLang=en)

![Prelude\_Wordmark\_Black\_Transparent.png\]](https://support.preludesecurity.com/hs-fs/hubfs/Prelude_Wordmark_Black_Transparent.png?height=50&name=Prelude_Wordmark_Black_Transparent.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Contact support](https://support.preludesecurity.com/kb-tickets/new)
- [Visit the website](https://www.preludesecurity.com/)

[Visit the website](https://www.preludesecurity.com/)

 Find what you're looking for

- There are no suggestions because the search field is empty.

1. [Knowledge Base](https://support.preludesecurity.com/?hsLang=en)
2. [Monitor](https://support.preludesecurity.com/monitor?hsLang=en)
3. [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration)

# Connecting the Microsoft Integration Suite

*Prelude integrates with multiple Microsoft use-cases/products. This page provides information to **manually** configure an all-in-one Microsoft App registration for all Prelude's integrations with Microsoft.  You can also accomplish this  [automatically](https://support.preludesecurity.com/microsoft-automated-integration-setup?hsLang=en) with a [single click](https://support.preludesecurity.com/microsoft-automated-integration-setup?hsLang=en)[here](https://support.preludesecurity.com/microsoft-automated-integration-setup?hsLang=en).*

 

**To attach Prelude to a Microsoft App registration, you will need:**

- The Prelude Dashboard / UI ([US1](https://platform.us1.preludesecurity.com/dashboard) | [EU1](https://platform.eu1.preludesecurity.com/dashboard)) or [Prelude CLI](https://docs.preludesecurity.com/docs/prelude-cli)
- An Azure user with Global Administrator role

### In Azure

 Create an App Registration

1. Navigate to the [App registrations section](https://portal.azure.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade) in the **Azure Portal**.
2. Select "**+ New registration**" toward the top of the page.
3. Enter a name for your application
4. Choose **Single tenant** as the supported account type (*Accounts in this organizational directory only*). Click Register.
5. Leave **Redirect URI (optional)** as it is.
6. After registration: 
     1. Note down the **Application (client) ID** and **Directory (tenant) ID** from the app's **Overview page**.
7. In the left menu, expand the **Manage** section and select **Certificates & secrets** and create a **new Client Secret**: 
     1. Click **New client secret**, enter a description, and set an expiration period.
     2. Note down the generated **Client Secret Value** (you won’t be able to view it later).

we now have:

- **APP ID** (*Application (client) ID*) from step 6
- **TENANT ID** (*Directory (tenant) ID*) from step 6
- **APP SECRET** (*Client Secret Value*) from step 7

 

### Roles and API Permissions Summary

While step by step guidance is provided in the next section, here we provide a quick summary table of all API Permissions and IAM Role Assignments required

 

**API Permissions**

| Use-Case | API | Permission Type | Permission |
| --- | --- | --- | --- |
| Defender | Microsoft APIs / Microsoft Graph | Delegated | `User.Read` |
| Defender | Microsoft APIs / Microsoft Graph | Application | `ThreatHunting.Read.All` `CustomDetection.ReadWrite.All`(\*) `DeviceManagementConfiguration.Read.All` |
| Defender | APIs my organization uses / WindowsDefenderATP | Application | `Machine.Read.All` `Alert.Read.All` `Ti.Read.All` |
| Intune | Microsoft APIs / Microsoft Graph | Delegated | `User.Read` |
| Intune | Microsoft APIs / Microsoft Graph | Application | `Device.Read.All` `DeviceManagementConfiguration.Read.All` `DeviceManagementManagedDevices.Read.All` |
| M365 (Email) | APIs my organization uses / Office 365 Exchange Online | Application | `Exchange.ManageAsApp` |
| M365 (Email) / Entra ID | Microsoft APIs / Microsoft Graph | Application | `MailboxSettings.Read` |
| Entra ID | Microsoft APIs / Microsoft Graph | Application | `AuditLog.Read.All` `IdentityRiskyUser.Read.All` `Policy.Read.All` `UserAuthenticationMethod.Read.All` `User.Read.All` `DeviceManagementConfiguration.Read.All` |

*(\*) Only required if sending detections to Defender. Not required for Security Control Monitoring*

 

 

**IAM Roles**

| Use-Case | Role |
| --- | --- |
| Defender | N/A |
| Intune | N/A |
| M365 (Email)\* | `Global Reader` |
| Entra ID | `Global Reader` |

(\*) *If your M365 configuration does not provide sufficient permission to Security Reader for reading the M365 policies then a higher, or custom role can be used.*

the next section provides a step by step guide to configure the API Permissions and Roles

 

### **Granting API Permissions**

1. In the left menu of the app you created, select **API permissions** and click **Add a permission**

 

**Defender**

1. Under "**Microsoft APIs**" select **Microsoft Graph** 
     1. `User.Read`Select Delegated Permissions and add the following API Permissions:
2. Select Application permissions (not Delegated) and add the following API Permissions.  
     1. `ThreatHunting.Read.All`
     2. `CustomDetection.ReadWrite.All` \*only if *sending detections to Defender*
     3. `DeviceManagementConfiguration.Read.All`
3. Under "**APIs my organization uses**" search for: "**WindowsDefenderATP**" select "**WindowsDefenderATP**"
4. Select Application permissions (not Delegated) and add the following API Permissions.  
     1. `Machine.Read.All`
     2. `Alert.Read.All`
     3. `Ti.Read.All`

 

**Intune**

1. Under "**Microsoft APIs**" select **Microsoft Graph**
2. Select Delegated Permissions and add the following API Permissions: 
     1. `User.Read`
3. Select Application permissions (not Delegated) and add the following API Permissions. 
     1. `Device.Read.All`
     2. `DeviceManagementConfiguration.Read.All`
     3. `DeviceManagementManagedDevices.Read.All`

 

 

**M365 (Email)**

1. Under "**APIs my organization uses**" search for: "**Office 365 Exchange Online**" select **Office 365 Exchange Online**
2. Select Application permissions (not Delegated) and add the following API Permissions. 
     1. `Exchange.ManageAsApp`
3. Under "**Microsoft APIs**" select **Microsoft Graph**
4. Select Application permissions (not Delegated) and add the following API Permissions  
     1. `MailboxSettings.Read`

 

 

**Entra ID**

1. Under "**Microsoft APIs**" select **Microsoft Graph**
2. Select Application permissions (not Delegated) and add the following API Permissions.  
     - `AuditLog.Read.All`
     - `IdentityRiskyUser.Read.All`
     - `Policy.Read.All`
     - `UserAuthenticationMethod.Read.All`
     - `User.Read.All`
     - `DeviceManagementConfiguration.Read.All`

#### Granting Admin Consent

 

**Note**: After adding the above permissions ensure you select "Grant admin consent for " as show in the screenshot below:

![](https://support.preludesecurity.com/hs-fs/hubfs/Knowledge%20Base%20Import/bb45d76b14f5e436491948793b3c9855e37e7e7c2f15cedb590452e374137827-image.png?width=688&height=269&name=bb45d76b14f5e436491948793b3c9855e37e7e7c2f15cedb590452e374137827-image.png)

### **Granting IAM Roles**

This is required for Entra and M365 integrations.

**Note:** There is [an alternative process](https://support.preludesecurity.com/how-to-connect-m365-and-entra-without-global-reader?hsLang=en) that can be used in place of granting Global Reader and instead uses the lesser privileged "View-Only Recipients" and "Security Reader" roles, but does require running a powershell script.  

 

1. Navigate to [Entra ID](https://portal.azure.com/#view/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/~/Overview) in the **Azure portal**
2. Expand **Manage** and select "**Roles and Administrators**" on the left hand side
3. Search for the "**Global Reader**" role and click on it
4. On the next screen, select **Add Assignment**
5. In the "Search" field, enter the **whole** App ID that you created in the above steps and assign it to the Global Reader role:  
   ![](https://support.preludesecurity.com/hs-fs/hubfs/screenshot_2504-png.png?width=688&height=318&name=screenshot_2504-png.png)

 

 

**In Prelude**

Follow the instructions to attach the relevant technology:

- [Defender](https://docs.preludesecurity.com/docs/microsoft-defender-1#in-prelude)
- [Intune](https://docs.preludesecurity.com/docs/microsoft-intune#in-prelude)
- [M365 (Email)](https://docs.preludesecurity.com/docs/microsoft-m365-integration#in-prelude)
- [Entra ID](https://docs.preludesecurity.com/docs/entra-id#in-prelude)

- [Monitor](https://support.preludesecurity.com/monitor?hsLang=en#main-content)

    - [Introduction to Control Monitor](https://support.preludesecurity.com/monitor?hsLang=en#introduction-to-control-monitor)
    - [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration)
    - [Client Hardware Security Integrations](https://support.preludesecurity.com/monitor?hsLang=en#client-hardware-security-integrations)
    - [Device Discovery Integrations](https://support.preludesecurity.com/monitor?hsLang=en#device-discovery-integrations)
    - [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations)
    - [Email Integrations](https://support.preludesecurity.com/monitor?hsLang=en#email-integrations)
    - [Identity Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#identity-management-integrations)
    - [Endpoint Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#endpoint-management-integrations)
    - [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations)
    - [Reporting](https://support.preludesecurity.com/monitor?hsLang=en#reporting)
    - [Troubleshooting](https://support.preludesecurity.com/monitor?hsLang=en#troubleshooting)
- [Detect](https://support.preludesecurity.com/detect?hsLang=en#main-content)

    - [Basics](https://support.preludesecurity.com/detect?hsLang=en#basics)
    - [Integrations](https://support.preludesecurity.com/detect?hsLang=en#integrations)
    - [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment)
    - [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests)
    - [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression)
    - [Assurance](https://support.preludesecurity.com/detect?hsLang=en#assurance)
- [Integrations](https://support.preludesecurity.com/integrations?hsLang=en#main-content)

    - [SASE](https://support.preludesecurity.com/integrations?hsLang=en#sase)
- [Account](https://support.preludesecurity.com/account?hsLang=en#main-content)

    - [SSO](https://support.preludesecurity.com/account?hsLang=en#sso)
- [CLI](https://support.preludesecurity.com/cli?hsLang=en)
- [Release Notes](https://support.preludesecurity.com/release-notes?hsLang=en)

[![Origin Technology Logo](https://support.preludesecurity.com/hs-fs/hubfs/origin_logo_inverse_000000.png?width=5000&height=5000&name=origin_logo_inverse_000000.png "Origin Technology Logo")](http://originhq.com)

Prelude Security Knowledge Base

Copyright © 2026, Origin Technology