What is the Integration with CybSafe and MS 365 for?
Now, you can connect your organisation’s Microsoft 365 apps to CybSafe, cast that net wider, and capture a broader range of security behaviour data for CybSafe to crunch.
To explore more on our security behaviours, take a look at SebDB, its an amazing resource even if we say so ourselves!
This integration is currently focused on growing the number of measurable security behaviours to help your people improve. Integrating with more software and gathering the data allows us to do this.
CybSafe tracks these security behaviours from Microsoft 365 and Entra:
Authenticates with SSO, from sign-ins to Microsoft 365.
Works only on an approved device, when a sign-in comes from a compliant, managed device.
Authenticates with MFA, Authenticates with a passkey, Authenticates with a security key and Authenticates with biometrics, from Entra's authentication methods report (needs Entra ID P1 or P2).
Reports a suspicious message, when someone reports a message in Outlook.
Keeps a password private, Shares sensitive information only with an approved recipient and Shares sensitive information only in an approved communication channel, from Purview DLP rules you have switched on.
These events feed your behaviour reports and people's behaviour scores. The full list, and what each one needs, is in Security behaviors tracked by CybSafe and our integrations.
How to setup the MS 365 integration
Follow the steps below to setup the integration between CybSafe and MS 365.
🆔 Step 1: Obtain your MS 365/Microsoft Entra ID tenant_id. You can find this in your Microsoft Entra admin center. NB: Before you start, please also make sure unified audit logging is enabled in your organisation
🤞 Step 2: Click on the 'Complete Setup' at the bottom of the integrations page for MS 365.
✍️ Step 3: You will be directed to a form, please enter your tenant_id and click submit
⚙️ Step 4: You will be directed to the relevant MS Portal to grant permissions for the integration. The permissions required are:
User.Read: Sign in and read user profile.SecurityEvents.Read.All: Read your organisations security events.ActivityFeed.Read: Read activity data for your organisation.ActivityFeed.ReadDlp: Read DLP policy events including detected sensitive data.
Need to grant a permission later? Use Update permissions on the connection. See Managing your integrations.
You will be asked to login and be shown some information about the connection, please accept the permissions to complete the integration. 👇
And that's it! You are all done. 🏖️
Still have questions?
If you still have questions, you can contact the CybSafe team via [email protected]. We’re on hand to help resolve any further issues!