Skip to main content

Connect Microsoft 365 to Anzenna

Integrate Anzenna with Microsoft 365 to monitor OneDrive, SharePoint, Teams, Exchange, and enable optional security remediation capabilities.

Prerequisites​

  • Microsoft 365 Global Administrator access
  • Anzenna account
  • Azure AD admin permissions
  • PowerShell (for optional features)

Overview​

The integration provides:

  • OneDrive and SharePoint activity monitoring

  • Teams collaboration tracking
  • Exchange email monitoring
  • User activity logs
  • Optional: Password reset capabilities
  • Optional: Software uninstall capabilities
  • Optional: Audit log recording

Step-by-Step Instructions​

Part 1: Initial Connection​

  1. Sign into

    app.anzenna.ai

  2. Navigate to Settings > Integrations

  3. Select Connect Apps

  4. Click Connect to Microsoft 365

Part 2: Microsoft Authentication​

  1. Review the requested permissions

  2. Click Accept to grant permissions

  3. Sign into your Microsoft account

  4. Complete the authentication process
  5. Return to Anzenna to verify connection

Optional Feature Configurations​

Option 1: Password Reset Permissions​

Enable Anzenna to reset potentially compromised user passwords.

Access Azure Portal​

  1. Navigate to

    portal.azure.com

  2. Go to Microsoft Entra ID (formerly Azure AD)

  3. Click Roles and administrators

Assign Password Administrator Role​

  1. Search for Password Administrator

  2. Click on the role to open it

  3. Click Add assignments

  4. Search for Anzenna service principal

  5. Select the Anzenna app

  6. Click Add to assign the role

Role Limitation

This role allows Anzenna to reset regular user passwords but not administrator passwords, maintaining security boundaries.

Grant Microsoft Graph Permissions​

  1. Open PowerShell as administrator
  2. Run the following script to grant permissions:
# Install Microsoft Graph module
Install-Module Microsoft.Graph -Scope CurrentUser

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All"

# Get Anzenna Service Principal
$sp = Get-MgServicePrincipal -Filter "displayName eq 'Anzenna'"

# Get Microsoft Graph Service Principal
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

# Grant User.ReadWrite.All permission
$appRole = $graph.AppRoles | Where-Object {$_.Value -eq "User.ReadWrite.All"}
New-MgServicePrincipalAppRoleAssignment `
  -ServicePrincipalId $sp.Id `
  -PrincipalId $sp.Id `
  -ResourceId $graph.Id `
  -AppRoleId $appRole. `
  1. Verify the script completes without errors

Option 2: Software Uninstall Permissions​

Enable Anzenna to uninstall applications from managed devices.

Grant Microsoft Graph Permissions​

  1. Ensure PowerShell is installed

  2. Run the following script:

    # Install Microsoft Graph module
    Install-Module Microsoft.Graph -Scope CurrentUser

    # Connect to Microsoft Graph

    Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All"

    # Get Anzenna Service Principal

    $sp = Get-MgServicePrincipal -Filter "displayName eq 'Anzenna'"

    # Get Microsoft Graph Service Principal

    $graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"

    # Grant DeviceManagementConfiguration.ReadWrite.All permission

    $appRole = $graph.AppRoles | Where-Object {$_.Value -eq "DeviceManagementConfiguration.ReadWrite.All"}

    # Assign the AppRole

    New-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $sp.Id -PrincipalId $sp.Id -ResourceId $graph.Id -AppRoleId $appRole.Id
  3. Verify the script completes without errors

Option 3: Activity Monitoring (Audit Logs)​

Enable recording of user and administrator activity.

  1. Navigate to

    compliance.microsoft.com

    (formerly purview.microsoft.com)

  2. Go to Audit section

  3. Click Start recording user and admin activity

  4. Enable audit log recording
Audit Log Retention

Audit logs have retention limits based on your Microsoft 365 license. E5 licenses offer longer retention periods.

Verification​

  1. Return to Anzenna > Integrations

  2. Verify Microsoft 365 shows Connected

  3. Wait 30 minutes for initial sync

  4. Check Documents dashboard for OneDrive files

  5. Review Activity logs for user events

  6. If enabled, test password reset capability in sandbox

What Data is Collected​

OneDrive & SharePoint​

  • File activity (create, modify, delete)
  • Sharing events
  • Permission changes
  • Download activity
  • External sharing

Microsoft Teams​

  • Team creations
  • Channel activity
  • File sharing in Teams
  • Guest additions
  • Chat file transfers

Exchange Online​

  • Email activity (optional)
  • Mailbox access
  • Forwarding rules
  • External email sharing

User Activity​

  • Login events
  • Application usage
  • Device sign-ins
  • Risk detections
  • Admin actions

Devices​

  • Enrolled devices
  • Compliance status
  • Installed applications
  • Security settings

Remediation Capabilities​

With optional permissions enabled:

Password Reset​

  • Reset compromised user passwords
  • Force password change on next login
  • Exclude administrators from resets
  • Logged in both Anzenna and Azure AD

Software Management​

  • Uninstall risky applications
  • Remove unauthorized software
  • Deploy security patches
  • Manage device configurations

Troubleshooting​

Connection Fails​

Authorization errors:

  • Verify Global Administrator role
  • Check permissions were accepted
  • Ensure service principal exists
  • Review Azure AD sign-in logs

PowerShell Script Errors​

Script fails to run:

  • Run PowerShell as Administrator
  • Install Microsoft.Graph module
  • Verify internet connectivity
  • Check Azure AD permissions

No Audit Data​

Activity logs not appearing:

  • Verify audit logging is enabled
  • Wait 24 hours for initial data
  • Check license includes audit logs
  • Review compliance center settings

Password Reset Not Working​

Cannot reset passwords:

  • Verify Password Administrator role assigned

  • Check Graph API permissions granted
  • Ensure user is not an administrator
  • Review Azure AD audit logs for errors

Security Considerations​

  • Service principal - Anzenna uses Azure AD app identity

  • Role-based access - Only grants specific permissions

  • Admin exclusion - Cannot reset admin passwords

  • Audit trails - All actions logged in Azure AD

  • Revocable - Permissions can be removed anytime

Best Practices​

  1. Start with monitoring - Add remediation features later

  2. Test in sandbox - Verify password reset with test user

  3. Monitor audit logs - Review Anzenna's actions regularly

  4. Document permissions - Record which features are enabled

  5. Regular reviews - Audit permissions quarterly

  6. User notification - Inform about password reset capability

  7. Emergency procedures - Document how to revoke access quickly

Integration Maintenance​

Regular Checks​

Perform monthly:

  • Verify connection status
  • Review data sync freshness
  • Check audit log coverage
  • Test remediation capabilities

Permission Updates​

To modify permissions:

  1. Edit app registration in Azure AD
  2. Grant or revoke API permissions
  3. Admin consent may be required
  4. Changes take effect immediately

Service Principal Management​

Monitor service principal:

  • Review sign-in logs
  • Check for any failures
  • Audit actions performed
  • Verify certificate expiration

Microsoft 365 License Requirements​

Different licenses provide different data access:

LicenseAudit RetentionAdvanced Features
Business Basic90 daysLimited
Business Standard90 daysStandard
E390 daysAdvanced
E5365 daysAll features

Need help? Contact

Anzenna Support

for assistance.