About

The Microsoft integration connects ControlMap to your client's Microsoft environment and collects evidence for compliance checks automatically. You connect once, then choose which Microsoft products ControlMap should read from. The data is read-only, and your credentials are encrypted.

There are two versions, both in the Add Integration list:

• Microsoft, for standard Microsoft cloud tenants. You sign in with Microsoft and an admin approves access.
• Microsoft GCC, for tenants in the US Government cloud (Government Community Cloud). You enter the details of an app your client has registered.

Each version carries these products:

• Azure Active Directory (Azure Active Directory - GCC in Microsoft GCC)
• Microsoft Intune (Microsoft Intune - GCC)
• Microsoft Office 365 (Microsoft Office 365 - GCC)

Connections you made earlier as separate Azure Active Directory, Microsoft Intune or Microsoft Office 365 integrations still appear as their own cards on the Integrations page.

What each product collects

Each product brings in its own data and runs its own compliance checks:

• Azure Active Directory: users, admins, and their groups and roles. Check: Collect users, admins and group info from Microsoft Active Directory.
• Microsoft Office 365: users, admins and groups, plus multi-factor authentication (MFA) details. Checks: List of users who have access to microsoft office 365, Office 365 users have MFA enabled, Office 365 admin users have MFA enabled.
• Microsoft Intune: user accounts and devices, which appear as assets. Checks: All user accounts in MS Intune are assigned an employee / owner, Each device in MS Intune has an owner assigned, MS Intune admins have MFA enabled, MS Intune users have MFA enabled.

Before you start

Have these ready:

• Setting up integrations from the client portal is part of the Pro plan. For details, see the Free, Essentials and Pro plans article.
• For Microsoft: the Tenant ID (your client's Microsoft directory ID), and a Microsoft admin for your client's tenant who can approve ControlMap's access when Microsoft asks.
• For Microsoft GCC: an app your client has registered in their government cloud Microsoft directory, with its Tenant ID, App ID and App Secret.

Connect Microsoft

1. Go to Monitor › Integrations and select Add Integration.
2. Search for Microsoft and select the Microsoft card. The Microsoft GCC card sits next to it.

3. On the Connection step, enter the Tenant ID.
4. Optional: tick Setup emails discovered as employees in ControlMap. Any new email address ControlMap finds is then added as an employee. When this is ticked, you can also choose Invite employees to Compliance Portal.
5. Select Connect to Microsoft. ControlMap takes you to Microsoft, where an admin for the tenant approves access. Microsoft then returns you to the setup page.

6. Once the connection is saved, the Select Products list becomes available and Azure Active Directory is switched on. Tick Azure Active Directory, Microsoft Intune and Microsoft Office 365 as you need them. At least one product must stay ticked.

Connect Microsoft GCC

1. Go to Monitor › Integrations, select Add Integration, and select the Microsoft GCC card.
2. On the Connection step, enter the Connection name, Tenant ID, App ID and App Secret from the app your client registered.
3. Optional: tick Setup emails discovered as employees in ControlMap.
4. Select Connect to Microsoft GCC. There is no Microsoft sign-in step for GCC.
5. Choose your products in the Select Products list: Microsoft Office 365 - GCC, Microsoft Intune - GCC and Azure Active Directory - GCC.

Finish the setup

Both versions use the same five steps, shown along the top of the page: Connection, Checks, Inclusions & Exclusions, Watchers and Schedule. After the Connection step:

1. Checks: switch each compliance check on or off. The table shows CHECK, FRAMEWORK and ENABLED, and checks run automatically on each sync. Select Next: Checks to reach this step.
2. Inclusions & Exclusions: choose Use Inclusion Rules or Use Exclusion Rules, then list emails, email patterns, group names or group patterns. You can also include or exclude service accounts, inactive and disabled accounts, and accounts with missing email addresses. Accounts left out of the sync, and the user accounts and people records created from them, are removed to match.
3. Watchers: choose who is notified when the connection's status changes. You are added by default.
4. Schedule: scans run weekly. Choose the Day of the week and the Time of the day. Results and evidence are kept for 180 days.

When you finish, the new connection's page opens. Its data starts to appear in the other Monitor tabs after the first scan. Select Cancel on the first step to return to the Integrations list.

See the results

Results appear in the Monitor tabs, mixed with data from your other integrations:

• User Accounts: users from Azure Active Directory, Microsoft Office 365 and Microsoft Intune.
• Assets: devices from Microsoft Intune.
• Compliance Checks: the result of each check above. A check shows No Data until the first scan finishes.

Use the Integration column and filter in those tabs to tell connections apart.

Manage the connection

Go to Monitor › Integrations and select the connection's card. Its page has these tabs: Connection, Schedule, Inclusions and Exclusions, Watchers, Logs and Help. The Connection tab shows:

• Connection Status: status, protocol, last synced, records synced and category.
• Credentials: the tenant ID and employee options.
• Connected Products and Select Products: the products you can add.

To manage products and syncs:

• Add a product: tick it in Select Products.
• Remove a product: select Disconnect next to it. Its users and devices are hidden and its checks stop. They come back if you connect the product again. Disconnect is unavailable when it is the only connected product.
• Sync now: select Run Once. While a scan runs, Force stop appears.
• Delete the whole connection: select the bin icon on its card and choose Yes. This also deletes its assets and their compliance status.