Connecting Microsoft 365

What you get

Once M365 is connected, Radius360 receives:

• User and license inventory. Users, guest accounts, licenses, and MFA registration status.
• Conditional Access policies. Whether Conditional Access policies exist and are enforced.
• Privileged roles. Who holds Global Administrator and other directory roles.
• Secure Score. Microsoft's overall security score, pulled into the Posture Score.
• Email security. DMARC posture and whether an anti-phishing policy is in place.
• Intune. Device compliance and disk encryption coverage (if Intune-managed).
• Apps and AI discovery. Service principals, OAuth grants, and Teams apps, checked against Radius360's AI catalog.

Framework controls addressed:

• SOC 2 CC6.1, CC6.6, CC6.7 (logical access, external protection, data in motion)
• ISO 27001:2022 A.5 (Organizational), A.8 (Technological): access management, communications security
• NIST CSF 2.0 PR.AA (Identity & Access), PR.DS (Data Security), PR.PS (Platform Security)
• HIPAA 164.308, 164.312 (for tenants handling PHI)

Prerequisites

• A Microsoft Entra admin who can create an app registration and grant admin consent (Global Administrator, or Privileged Role Administrator plus Application Administrator)
• M365 Business Premium, E3, or E5 (some signals require E5; the integration tells you which)
• About 5 minutes

Connecting Microsoft 365

1. 1
   In the Microsoft Entra admin center, go to App registrations and create a new registration.
2. 2
   Under API permissions, add these Microsoft Graph application permissions (all read-only) and click Grant admin consent: Directory.Read.All, Policy.Read.All, AuditLog.Read.All, DeviceManagementConfiguration.Read.All.
3. 3
   Under Certificates & secrets, create a client secret and copy its value now. Microsoft shows it only once.
4. 4
   In Radius360, open Integrations, find Microsoft 365, and click Connect. Paste the Directory (tenant) ID, Application (client) ID, and client secret, then click Save & Connect. Radius360 tests the connection before saving. Click Sync to run the first sync.
5. 5
   Once Connected, open the Evidence Vault and filter Source to Microsoft 365. You will see a batch of evidence artifacts tagged with the specific controls they satisfy.

Entra (Azure AD) vs M365

Radius360 has two Microsoft identity-related integrations: Microsoft 365 (deep) and Microsoft Entra ID (standard; Entra is the new name for Azure AD). They overlap but focus on different data.

Microsoft 365 is the deep integration: MFA registration, Conditional Access, privileged roles, guest accounts, Secure Score, Intune device posture, and email security, turned into scored risks and per-control evidence.

Microsoft Entra ID is a standard integration: it pulls the user directory (for training rosters) and Conditional Access policy status as evidence.

For most tenants Microsoft 365 is the one to connect; it already covers the identity risks. Connecting both does not cause conflicts.

Troubleshooting

Connection test fails. Check the tenant ID, client ID, and secret value (not the secret ID), and that the secret has not expired. If the test passes but data is missing, confirm admin consent was granted for every permission.

Some data is missing (e.g., Conditional Access or device compliance). Conditional Access requires Microsoft Entra ID P1 or higher, and device data requires devices enrolled in Intune. Upgrade the license or use what is available on your current tier.

Secure Score is 0. Microsoft computes Secure Score on a delay after tenant creation. For new tenants, give Microsoft 24 to 48 hours to populate, then re-sync.

For connection issues, email support@radius360.co or ask the GRC Assistant.