Connect Microsoft 365

Everything Qorionix knows about your Microsoft 365 estate arrives through one connection. The connector is called Microsoft Entra ID (Microsoft 365) and its internal identifier is entra_id. This article is the procedure for creating it, the three values you will need, and what we check the moment you save.

Budget about fifteen minutes. Nothing in this procedure changes a setting in your tenant, adds a prompt for your staff, or installs anything on a machine.

What you are connecting

Qorionix talks to Microsoft Graph as an application, not as you. The grant type is OAuth2 client credentials, which means there is no signed-in user behind our requests and no delegated permission inherited from whoever set the connection up. If the person who created the connection leaves the company and their account is disabled, the connection keeps working — and equally, our access does not quietly expand when someone is promoted.

The connection is defined by three values you generate in your own tenant and paste into Qorionix:

`tenant_id`

Your directory. We accept either the GUID or one of your verified domains; anything that is neither is refused at the point you save, not later.

`client_id`

The application (client) ID of the app registration you create below. This must be a GUID.

`client_secret`

A secret you generate on that app registration. It is encrypted at rest and never displayed back to you.

By default we talk to https://login.microsoftonline.com for tokens and https://graph.microsoft.com/v1.0 for data. Both are overridable, which is what makes a sovereign cloud a configuration change rather than a different product.

Before you start

• You need to be able to create an app registration in Entra ID, and you need someone who can grant tenant-wide admin consent. In a small organisation that is usually the same person — a Global Administrator.
• Decide where the client secret will live afterwards. You will need to replace it before it expires, and a secret in somebody's inbox is a problem of its own.
• Have the full permission list open in another tab. You will be ticking twelve boxes and it is quicker with the list beside you.

The procedure

1. 1

   Create the app registration

   In the Microsoft Entra admin centre, go to Identity → Applications → App registrations and choose New registration. Name it something a future colleague will recognise — Qorionix posture assessment rather than App1. For supported account types choose Accounts in this organizational directory only. Leave the redirect URI empty: there is no browser sign-in in this flow, so a redirect URI would be an unused surface.

2. 2

   Copy the two identifiers

   On the registration's Overview page, copy the Application (client) ID and the Directory (tenant) ID. These are the first two of the three values. Neither is a secret, but note them somewhere you can find again — you will need the client ID to audit what the application has been doing.

3. 3

   Add the application permissions

   Go to API permissions → Add a permission → Microsoft Graph, and choose Application permissions — not Delegated permissions. Delegated permissions describe what an app may do on behalf of a signed-in user, and there is no signed-in user here, so a delegated grant produces a connection that authenticates and then reads nothing. Add the twelve permissions listed in Every permission we ask for, and why. Every one of them is a read permission.

4. 4

   Grant admin consent

   Still on API permissions, choose Grant admin consent for <your organisation>. Until you do this the permissions are requested but not effective, and the status column will say so. This is the moment the access actually exists, and it is recorded in your tenant's audit log with your name against it.

5. 5

   Create the client secret

   Go to Certificates & secrets → Client secrets → New client secret. Give it a description that includes the expiry — Qorionix, expires 2027-08 — and choose the shortest lifetime you are willing to rotate at. Copy the Value immediately: Microsoft shows it once and never again. The Secret ID is not the secret.

6. 6

   Paste the three values into Qorionix

   In Qorionix, open Integrations → Add integration → Microsoft Entra ID (Microsoft 365) and enter the tenant ID, the client ID and the secret value. Save. The secret is encrypted before it is stored and is never rendered back into a form field.

7. 7

   Start a posture run

   With the connection enabled, start a posture run. We resolve your single enabled Microsoft 365 connection automatically, so there is nothing else to choose. What happens over the following half hour is described in What happens in the first hour.

Sync users into the Qorionix directory

Directory sync runs when you select Sync on the connection; saving or testing a connection does not schedule recurring user imports. Guest accounts are excluded unless you enable them. If you configure a user filter, each sync reads Microsoft's filtered user list from the beginning, follows all pages, and does not use an incremental delta cursor. If the filtered list exceeds the sync limit, the import stops with an error instead of claiming that a partial list is complete. Without a filter, later syncs use incremental changes after a full import.

Connecting Microsoft 365 and importing its users are separate steps. Open the connection in Integrations → Connections and run its directory sync. A completed import reports users actually created or updated in Qorionix. Use View users or open People and profiles → Users, check that the same organisation is selected, and refresh the list. A dry run previews the import and does not create users.

The import preserves existing administrator credentials and roles. New imported users receive the organisation's member role; the sync does not fall back to granting administrator access if that role is unavailable. Matching and creation are checked within the current organisation. Review any warning rather than assuming that every object returned by Microsoft was imported.

If a previous sync said it found or created users but they were absent from the directory, run the connection's sync again. Connections carrying an older discovery-only result are refreshed as a full import. If users are still missing, record the sync time, result and warnings, confirm your organisation and access permissions, and contact support. Do not remove your working administrator to make the counts match.

Sovereign clouds

Microsoft Graph has separate endpoints for the US Government and China clouds. Both the login base and the Graph base are configurable per connection, so a tenant in one of those clouds is a configuration change rather than a different product. Two constraints apply: both must be HTTPS, and we refuse to follow any link Graph returns whose host does not match the Graph base you configured. That second rule exists because we follow @odata.nextLink values that Graph itself supplies, and a poisoned link pointing somewhere else would carry our bearer token with it.

What we check the moment you save

Saving the connection runs a health check with two halves, and both matter. Acquiring a token proves the client secret has not expired. Reading /organization proves the app registration actually holds the Graph application permissions you think you granted — which a token alone does not prove, because Entra issues a perfectly valid token to an application with no permissions at all.

Three outcomes are possible, and each says something different:

Healthy

We report connected to <your organisation name> (<your default domain>). Seeing your own company name here is the confirmation that the tenant ID is the tenant you meant.

Degraded

A token was acquired but Graph rejected the read. The message reads token acquired but Graph rejected the request: followed by Microsoft's own error. In practice this is a missing permission or a consent that was never granted — a configuration problem, not an outage.

Unreachable

We could not get a token at all: could not acquire a Graph token: followed by Entra's error description. That description is verbose, but it is also the only place that says something like client secret expired on 2026-06-01, which is the single most useful sentence an administrator can be shown at this point, so we pass it through rather than tidying it away.

When something is wrong

The connector is resolved and its credentials are decrypted before a posture run is created, so a broken connection produces an immediate explanation rather than a run that sits at discovering and dies quietly thirty seconds later. The response is a 409 headed we cannot reach your Microsoft 365 tenant yet, with one of these underneath:

no Microsoft 365 connection has been set up for this organisation yet, so
there is nothing to look at. Connect Microsoft 365 first and then start a
posture run

this organisation has more than one enabled Microsoft 365 connection, so we
cannot tell which estate to look at. Name one with instance_id

that Microsoft 365 connection is switched off. Enable it and then start a
posture run

The middle one is deliberate. With two enabled Microsoft 365 connections we will not guess, because discovering the wrong estate produces a report about the wrong company, and no amount of later correction undoes the customer having read it.

During discovery itself, a permission Graph refuses produces a message that names the cause rather than shrugging:

Forbidden: <Microsoft's message> (check the app registration's Graph
application permissions and that admin consent was granted)

A refused read does not fail the whole assessment. It becomes a coverage gap, the checks that depend on that dataset are recorded as skipped, and nothing is assumed to be fine. That behaviour is the subject of When a check cannot run.

Keeping the connection alive

Entra client secrets expire on a schedule you chose when you created them, and a silently dead integration is the most common incident in this category by a wide margin. Put the expiry date in whatever calendar your organisation actually looks at. Rotating is a two-minute job: create a second secret on the same app registration, paste the new value into Qorionix, confirm the health check goes green, then delete the old secret.

What happens next

1. Read the permission list — twelve read permissions, each tied to a named Graph call and a specific check.
2. Follow the first hour — what discovery does, in what order, and what the status messages mean.
3. Understand what your licence limits — some checks need Entra ID P1, and we say so rather than reporting a pass.