If you connected Microsoft Azure to Intruder before Microsoft 365 security checks were released, your Azure app registration needs three additions: nine more Microsoft Graph API permissions, two external API permissions, and the Global Reader role. You don't need to re-add the integration, create a new client secret, or change anything in the Intruder portal.
🎫 Plan availability: The Microsoft Azure integration and M365 checks are available on all plans.
The number of cloud environments you can run cloud security scans on depends on your plan:
Free, 1 cloud environment
Cloud, up to 3
Pro, up to 10
Enterprise and Vanguard, unlimited.
ℹ️ Note: This guide covers updating an existing Azure integration. If you're connecting Azure to Intruder for the first time, follow the Microsoft Azure integration guide instead. It already includes every permission listed here.
What changed in the Azure integration?
The Microsoft Azure integration now asks for a wider set of read-only permissions so Intruder can run Microsoft 365 security checks against your tenant, alongside the cloud security scans it already runs on your Azure subscriptions. Integrations set up after the change pick these up during setup. Integrations set up before it keep their original three Microsoft Graph API permissions, which are enough to synchronize your targets and scan your subscriptions, but not enough for Microsoft 365 security checks.
What are Microsoft 365 security checks?
Microsoft 365 security checks are automated configuration checks Intruder runs against your Microsoft 365 tenant to find security misconfigurations, benchmarked against the CIS Microsoft 365 Benchmark. They inspect settings across Entra ID, Exchange Online, SharePoint, Teams, Intune, and Microsoft Defender. For example, they flag when your tenant has too many Global Administrators, or when Defender for Identity has unresolved health issues.
Microsoft 365 security checks run automatically as part of your daily cloud security scans, once per connected Azure tenant.
How to check whether your app registration needs updating
Check the Microsoft Graph permissions on your app registration. In the Azure portal, go to App registrations, open the app you created for Intruder (often named IntruderConnector), then go to Manage → API permissions.
If Microsoft Graph lists only these three permissions, your app registration predates Microsoft 365 security checks and needs updating:
Directory.Read.AllPolicy.Read.AllUserAuthenticationMethod.Read.All
A fully updated app registration has twelve Microsoft Graph permissions, two permissions under other APIs, and the Global Reader role assigned in Microsoft Entra ID. All three sections below need doing.
How to add the nine missing Graph API permissions
Add the nine new Microsoft Graph application permissions to the same app registration you already use.
On the API permissions page, click Add a permission → Microsoft Graph → Application permissions.
Select Application permissions, not Delegated permissions. Delegated permissions won't work for the integration.
Enable these nine permissions:
AuditLog.Read.AllOnPremDirectorySynchronization.Read.AllSecurityIdentitiesHealth.Read.AllSecurityIdentitiesSensors.Read.AllSharePointTenantSettings.Read.AllThreatHunting.Read.AllDeviceManagementServiceConfig.Read.AllDeviceManagementConfiguration.Read.AllDeviceManagementManagedDevices.Read.All
Click Add permissions.
Click Grant admin consent for [your tenant] and confirm.
Check that every permission shows a green check in the Status column.
Your three original permissions stay where they are. Don't remove them. Once all nine are added you should have twelve Microsoft Graph permissions in total.
How to add the two external API permissions
Add two permissions from APIs outside Microsoft Graph. These live under the APIs my organization uses tab, not Microsoft APIs.
ℹ️ Note: Type each API name out in full. Microsoft's search often returns nothing for pasted or partial entries.
First, add Exchange Online:
Click Add a permission → APIs my organization uses.
Type
Office 365 Exchange Onlineword for word and select it. If it doesn't appear, search by its app ID00000002-0000-0ff1-ce00-000000000000.Choose Application permissions, not Delegated. App-only authentication for the Exchange PowerShell module requires an application permission.
Expand the Exchange group, tick
Exchange.ManageAsApp, then click Add permissions.
Then add Teams:
Go back to the APIs my organization uses tab.
Type
Skype and Teams Tenant Admin APIword for word and select it. If it doesn't appear, search by its app ID48ac35b8-9aa8-4d74-927d-1f4a14a0b239.Choose Application permissions.
Tick
application_access, then click Add permissions.Back on the API permissions page, click Grant admin consent for [your tenant] and confirm. The Status column must show a green check for both.
How to assign the Global Reader role
Assign the Global Reader role to your app registration in Microsoft Entra ID. This gives Intruder read-only visibility across the Microsoft 365 admin settings the API permissions don't cover.
Go to Microsoft Entra ID (Azure Active Directory).
In the left menu, click Roles and administrators.
In the search box, type
Global Readerand click the role name to open it.Click + Add assignments.
In the Add assignments panel, click No member selected.
Search for your app registration's name and select it.
Click Add at the bottom of the panel.
To check it worked, go back to the Global Reader page, click Assignments, and confirm your app is listed.
⚠️ Important: The picker lists users, groups, and apps (service principals) together. Make sure you select your app registration, not a user with a similar name.
What you don't need to change
Nothing else about your Azure integration changes. In particular:
Don't re-add the integration. The permissions attach to the app registration you already have, so the connection in Intruder stays as it is.
Don't create a new client secret. Your existing secret still works, unless it has expired for unrelated reasons.
Don't re-enter your credentials. Your Directory (tenant) ID, Application (client) ID, and client secret are unchanged.
Don't change the Reader role. The Reader role you assigned during setup is what scans your subscriptions. Microsoft 365 security checks don't change it.
Don't run the PowerShell script from the setup guide. That script creates a new app registration from scratch, so it isn't a way to update an existing one. Use the steps above instead.
What happens if you don't update your app registration
Microsoft 365 security checks return incomplete results, and individual checks fail with a message naming the permission they need. For example:
Defender for Identity APIs are not accessible. Ensure the Service Principal has SecurityIdentitiesSensors.Read.All and SecurityIdentitiesHealth.Read.All permissions granted.
Making the change is safe to do at any time. Adding these permissions doesn't alter any permission already on your app registration, so your Azure target sync and your subscription-level cloud security scans carry on as they are.
FAQ
Do I need to re-add my Azure integration in Intruder?
No. The permissions sit on your Azure app registration, not in Intruder. Once you've added them and granted admin consent, Intruder picks them up on the next cloud security scan.
Do I need a new client secret?
No. Adding permissions doesn't invalidate your existing client secret.
Will my scans stop while I make these changes?
No. Your target sync and your subscription-level cloud security scans keep running throughout.
When will Microsoft 365 security checks start returning results?
After your next daily cloud security scan. Cloud security scans run once per day, automatically.
Does Intruder get write access to my Microsoft 365 tenant?
No. Exchange.ManageAsApp lets Intruder authenticate to Exchange Online as an application, and what it can do there is bounded by the directory roles assigned to the app. The only directory role Intruder asks for is Global Reader, which is read-only.
Do Microsoft 365 security checks use target licenses?
No. Cloud security scans and Microsoft 365 security checks don't consume target licenses.
I have more than one Azure tenant. Do I need to do this for each one?
Yes. Each Azure tenant has its own integration and its own app registration, so repeat these steps for each one you want Microsoft 365 security checks on.
Troubleshooting
I can't find "Office 365 Exchange Online" or "Skype and Teams Tenant Admin API" in the search.
Cause: You pasted the name, or typed only part of it. Microsoft's permission search often returns nothing for pasted or partial entries. → Fix: Type the name out in full, word for word.
Cause: You're on the Microsoft APIs tab. → Fix: Switch to the APIs my organization uses tab.
Cause: The API isn't provisioned in your tenant under that name. → Fix: Search by app ID instead. Exchange Online is
00000002-0000-0ff1-ce00-000000000000, and the Skype and Teams Tenant Admin API is48ac35b8-9aa8-4d74-927d-1f4a14a0b239.
A permission shows "Not granted for [tenant]" in the Status column.
Cause: Admin consent hasn't been granted since you added it. → Fix: Click Grant admin consent for [your tenant] and confirm. Every permission needs a green check.
Cause: Your account can't grant consent. → Fix: Granting tenant-wide admin consent needs the Global Administrator or Privileged Role Administrator role. Ask someone in your organization who holds one.
I can't assign the Global Reader role.
Cause: Your account doesn't have permission to assign directory roles. → Fix: Assigning a directory role needs the Privileged Role Administrator or Global Administrator role.
Cause: You selected a user instead of the app registration. The picker lists users, groups, and apps together. → Fix: Check the Assignments tab on the Global Reader role and confirm your app registration is the one listed.
Microsoft 365 checks are still failing after I added everything.
Cause: Admin consent wasn't granted after the last permission was added. → Fix: Return to API permissions and confirm every row shows a green check in the Status column.
Cause: The Global Reader role wasn't assigned, only the API permissions. → Fix: Assign Global Reader as described above. The API permissions alone aren't enough.
Cause: The scan hasn't run since you made the changes. → Fix: Wait for the next daily cloud security scan.
A check reports that an API isn't accessible, and it names a permission I've already added.
Cause: The permission was added but not consented. → Fix: Grant admin consent and confirm the green check.
Cause: The check relies on a Microsoft 365 service you don't use. → Fix: No action needed. The check passes or is skipped when the service isn't present.