Skip to main content

Microsoft 365 Discovery

Discover and audit Microsoft 365 tenant configurations.

Overview​

Microsoft 365 Discovery provides visibility into your identity, email, and collaboration security configurations. Connect your M365 tenant to discover Entra ID, Exchange Online, SharePoint, and Teams configurations—then assess them against the CIS Microsoft 365 Foundations Benchmark.

What's Discovered​

Entra ID (Azure AD)​

  • Users — Account status, MFA enrollment status
  • Groups — Security groups, M365 groups, distribution lists
  • App Registrations — Third-party apps with their permissions
  • Service Principals — Enterprise applications
  • Conditional Access — Policies and MFA requirements
  • Directory Roles — Privileged role assignments
  • Guest Users — External collaboration access

Privileged Access​

  • PIM Assignments — Eligible and active privileged roles
  • Risky Users — Users flagged by Identity Protection
  • Security Alerts — Identity-related security alerts

Exchange Online​

  • Mailboxes — Configuration and settings
  • External Forwarding — Mailboxes forwarding to external addresses
  • Audit Status — Mailbox audit logging enablement

SharePoint Online​

  • Sites — Site collections across the tenant
  • Sharing Settings — External sharing configurations

Microsoft Teams​

  • Teams — Team configurations
  • Guest Access — External collaboration settings

Security Posture​

  • Microsoft Secure Score — Your tenant's security score

Setup​

Prerequisites​

  1. Azure AD App Registration
  2. Required Microsoft Graph API permissions (see below)
  3. Admin consent for the permissions

Required Permissions​

Grant these Microsoft Graph API permissions to your App Registration:

PermissionTypePurpose
User.Read.AllApplicationDiscover users
Group.Read.AllApplicationDiscover groups
Directory.Read.AllApplicationDirectory roles, guest users
Policy.Read.AllApplicationConditional Access policies
RoleManagement.Read.AllApplicationPIM assignments
IdentityRiskyUser.Read.AllApplicationRisky user detection
SecurityEvents.Read.AllApplicationSecurity alerts
Mail.ReadApplicationMailbox discovery
Sites.Read.AllApplicationSharePoint sites

Configuration Steps​

  1. Go to Operations → Agentless Discovery
  2. Select Microsoft 365 tab
  3. Click Configure M365
  4. Enter:
    • Tenant ID — Your Azure AD tenant GUID
    • Client ID — App Registration application ID
    • Client Secret — App Registration client secret
  5. Click Test Connection
  6. Click Start Discovery

Compliance Assessment​

CIS Microsoft 365 Foundations Benchmark​

Infracast includes 23 automated rules covering:

Identity & Access

  • MFA enforcement for all users
  • MFA for administrators
  • Conditional Access policy configuration
  • Privileged role limits
  • Guest user review
  • PIM for privileged access

Application Security

  • App consent restrictions
  • Admin consent workflow
  • High-privilege app permission review

Data Protection

  • SharePoint external sharing
  • DLP policy configuration
  • Safe Attachments enabled
  • Safe Links enabled

Audit & Monitoring

  • Unified audit log enabled
  • Mailbox auditing enabled
  • Security alert monitoring

Exchange Security

  • External forwarding restrictions
  • Anti-spam policy configuration

Teams Security

  • External domain access
  • Guest access controls
  • Meeting recording policies

Security Posture

  • Microsoft Secure Score monitoring

Viewing Results​

Asset Graph​

Discovered M365 resources appear in the Asset Graph:

  • Filter by m365.* node types
  • View relationships between users, groups, and apps
  • See Conditional Access policy assignments

Compliance Findings​

View M365-specific findings:

  1. Go to Compliance → Findings
  2. Filter by framework: CIS M365
  3. Review findings by severity

Microsoft Secure Score​

Your tenant's Secure Score appears on:

  • M365 tenant node properties
  • Dashboard security metrics

Best Practices​

Identity Security​

  1. Enable MFA for all users — Start with administrators, then expand
  2. Use Conditional Access — Require MFA for risky sign-ins
  3. Implement PIM — Use just-in-time access for privileged roles
  4. Review guest access — Audit external users quarterly

Data Protection​

  1. Restrict external sharing — Limit SharePoint anonymous links
  2. Enable DLP — Protect sensitive data from accidental exposure
  3. Configure Safe Attachments/Links — Enable Microsoft Defender features

Monitoring​

  1. Enable unified audit log — Required for security investigations
  2. Monitor Secure Score — Track and improve your security posture
  3. Review security alerts — Investigate Identity Protection alerts promptly

Troubleshooting​

Authentication Failed​

  • Verify Tenant ID, Client ID, and Client Secret
  • Ensure the App Registration hasn't expired
  • Check that admin consent was granted for all permissions

Missing Resources​

  • Verify the App Registration has the required permissions
  • Some resources require specific licenses (e.g., PIM requires Azure AD P2)

Incomplete Discovery​

  • Large tenants may take longer to discover
  • Check for Graph API rate limiting
  • Retry discovery if results seem incomplete