Connect Microsoft 365

A read-only Microsoft Graph app registration — catches the identity risks that cause most SMB breaches.

1. 1Sign in with the correct administrator. Make sure you are in the correct Microsoft 365 Tenant Admin Center. On the menu on your left click on “Show all”, then click on “All Admin centers”, then click on “Microsoft Entra”. Sign in to the Microsoft Entra admin center using an account in the Microsoft 365 tenant that Cybermatic will scan. Because you are granting Microsoft Graph Application permissions, use an account assigned one of these Microsoft Entra roles: • Global Administrator • Privileged Role Administrator An Application Administrator or Cloud Application Administrator can normally configure an app registration, but Microsoft Graph application permissions require a Global Administrator or Privileged Role Administrator to grant tenant-wide consent. Make sure the tenant shown in the upper-right corner is the correct customer or company tenant before continuing.
2. 2Open App registrations. In the Microsoft Entra admin center: 1. Select Entra ID. 2. Select App registrations. 3. Select All applications. 4. Select New registration. Microsoft Entra app registration establishes the application identity Cybermatic will use when requesting Microsoft Graph access tokens.
3. 3Register the Cybermatic application. Enter the following — Name: Cybermatic M365 Read-Only Scanner Supported account types: select “Single Tenant Only – [Your Company Name]”. This makes the registration single-tenant and ties it to the Microsoft 365 organization being scanned. Redirect URI: leave the redirect URI blank. Cybermatic uses the OAuth 2.0 client credentials flow, which authenticates the application itself without interactive user login or a browser redirect. Select Register.
4. 4Record the Directory tenant ID. After registration, Microsoft opens the app’s Overview page. Locate “Directory (tenant) ID”, select the copy icon, and save the value temporarily. It will look like: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx This becomes: "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" Do not copy the tenant name or primary domain in place of this value.
5. 5Record the Application client ID. On the same Overview page, locate “Application (client) ID”, select the copy icon, and save it temporarily. It will also look like: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx This becomes: "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" Do not use: Object ID, Service principal Object ID, or Publisher domain. The required client ID is specifically the Application (client) ID assigned to the app registration.
6. 6Add all required Microsoft Graph permissions. In the left menu of the app registration: select API permissions → Add a permission → Microsoft Graph → Application permissions. Do not select Delegated permissions — Cybermatic runs as a server-side scanner without a signed-in Microsoft user, so it must use application permissions. Add each of the following, searching for the exact name and checking it: 1. Organization.Read.All — read organization and tenant information. 2. User.Read.All — read user profiles and related directory information. 3. Group.Read.All — read groups, group properties, and group memberships. 4. Device.Read.All — read devices registered in Microsoft Entra ID. 5. AuditLog.Read.All — make sure the name is exactly AuditLog.Read.All; do not accidentally select AuditLogsQuery.Read.All (those are different Microsoft Graph permissions). Used to inspect directory audit and sign-in activity exposed through Microsoft Graph. 6. Reports.Read.All — read Microsoft 365 and Microsoft Entra service-usage reports. Microsoft lists it as an application permission that requires administrator consent. 7. Policy.Read.All — read organizational policies without a signed-in user; requires administrator consent. 8. Directory.Read.All — a broad read-only directory permission. It can expose directory objects beyond users and groups, including applications, service principals, administrative units, roles, and other directory data. It does not allow Cybermatic to modify directory data, but it provides extensive tenant visibility. Microsoft recommends narrower permissions when they are sufficient; for this Cybermatic configuration, you are intentionally making it required. 9. UserAuthenticationMethod.Read.All — inspect authentication methods registered for users, useful for identifying users without MFA methods, registered phone authentication, Microsoft Authenticator registration, passkey registration, FIDO2 or other supported methods, and weak or incomplete authentication-method coverage. This permission does not expose password values and does not permit Cybermatic to sign in using a user’s authentication method. After checking all nine permissions, select Add permissions and return to the main API permissions page. Your list should contain exactly these Microsoft Graph Application permissions: AuditLog.Read.All, Device.Read.All, Directory.Read.All, Group.Read.All, Organization.Read.All, Policy.Read.All, Reports.Read.All, User.Read.All, UserAuthenticationMethod.Read.All — and the Type column should say “Application” for every permission.
7. 7Remove unnecessary delegated permissions. Microsoft sometimes adds a default delegated permission such as User.Read. If it appears and Cybermatic is using only background application authentication: 1. Select the three-dot menu beside User.Read. 2. Select Remove permission. 3. Confirm removal. Afterward, all remaining permissions should show Type: Application. There should be no required Delegated permissions for this scanner connection.
8. 8Grant administrator consent. Remain on App registration → API permissions. Select “Grant admin consent for [Your Organization]”, then select Yes when prompted. Tenant-wide administrator consent is required before Microsoft Entra includes these application permissions in tokens issued to the app. After consent is granted, verify that every permission shows a green status such as “Granted for Your Organization”. Check all nine: Organization.Read.All — Granted User.Read.All — Granted Group.Read.All — Granted Device.Read.All — Granted AuditLog.Read.All — Granted Reports.Read.All — Granted Policy.Read.All — Granted Directory.Read.All — Granted UserAuthenticationMethod.Read.All — Granted Do not continue until all nine show Granted. If the consent button is disabled or consent fails, confirm that your account is a Global Administrator or Privileged Role Administrator.
9. 9Create the client secret. In the app registration’s left menu: select Certificates & secrets → Client secrets tab → New client secret. Enter — Description: Cybermatic M365 Scanner. Expiration: choose the shortest expiration period your organization can reliably maintain (select an available organization-approved period and create a reminder to rotate the secret before it expires). Select Add. Microsoft will display columns including Description, Expires, Value, and Secret ID. Immediately copy the value under “Value” — Cybermatic needs the secret Value, not the Secret ID. The secret value is displayed only when it is initially created. If you leave the page without copying it, Microsoft cannot display it again; you must create a new secret.
10. 10Confirm the three required values. You should now have — Directory tenant ID: App registrations → Cybermatic M365 Read-Only Scanner → Overview → Directory (tenant) ID. Application client ID: App registrations → Cybermatic M365 Read-Only Scanner → Overview → Application (client) ID. Client secret: found when initially created at App registrations → Cybermatic M365 Read-Only Scanner → Certificates & secrets → Client secrets → Value. Do not use: Object ID, Secret ID, or Service principal ID.
11. 11Store the credentials in Cybermatic. When creating the Microsoft 365 connection in Cybermatic, enter — Directory (tenant) ID: Directory (tenant) ID Application (client) ID: Application (client) ID Client Secret: Client secret Value Click on + Connect M365.

Tip: Microsoft 365 is often the highest-value thing to connect — a mailbox without MFA is the single most common way small businesses get breached. Connect it even if most of your infrastructure is elsewhere.