> For the complete documentation index, see [llms.txt](https://cybrhawksoc.gitbook.io/cybrhawk-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cybrhawksoc.gitbook.io/cybrhawk-docs/microsoft-365/microsoft-365.md).
# Microsoft 365 Integration
This guide shows how to enable Microsoft 365 API access in CybrHawk SIEM.
> **Requirements:**
>
> * Access to Microsoft 365 services, including Microsoft 365 Compliance Center and Microsoft Entra ID
> * Any Microsoft 365 licensing tier
Click any screenshot to open the full-size image.
***
## Step 1: Enable auditing in Microsoft 365
Enable auditing before you continue. Follow Microsoft’s guide to [turn auditing on or off](https://learn.microsoft.com/en-us/purview/audit-log-enable-disable).
***
## Step 2: Register an application in Entra ID
1. Download CybrHawk’s Entra ID integration certificate from the SOC team.
2. Sign in to the [Entra ID portal](https://portal.azure.com).
3. Open **Microsoft Entra ID**
4. Select **App registrations** and click **New registration**
5. Enter the required details, then click **Register**
6. Save the **Application (client) ID** and **Directory (tenant) ID** for later
7. Open **Certificates & secrets**.
8. Click **Upload certificate**
9. Upload the certificate from step 1, then click **Add**.
***
## Step 3: Grant API Permissions
1. After creating the application, grant permissions to the Office 365 Management APIs
1. Open **API permissions** and select **Office 365 Management APIs**
1. Select **Application permissions** and enable the following:
```
ActivityFeed.Read
ActivityFeed.ReadDlp
```
4. Click **Grant admin consent** and confirm
***
## Step 4: Configure CybrHawk SIEM
1. Log in to the **CybrHawk SIEM Portal**.
2. Go to **Deployments** > **Integrations**.
3. Click **Add** and select **Microsoft 365**.
***
## Step 5: Add Microsoft Graph Integration
For advanced security auditing, Defender event ingestion, and user isolation features, complete the [MS365 Graph API](/cybrhawk-docs/microsoft-365/ms-graph.md).
***