: Onboard an Office 365 App to SSPM
Focus
Focus

Onboard an Office 365 App to SSPM

Table of Contents

Onboard an Office 365 App to SSPM

Connect an Office 365 instance to SSPM to detect posture risks.
For SSPM to detect posture risks in your Office 365 instance, you must onboard your Office 365 instance to SSPM. Through the onboarding process, SSPM connects to a Microsoft API and, through the API, scans your Office 365 instance at regular intervals for misconfigured settings. If there are misconfigured settings, SSPM suggests a remediation action based on best practices.
Connecting to Office 365 enables SSPM to scan settings at a high level based on Microsoft's Secure Score. For greater visibility into a particular application in the Office 365 product family, onboard the individual product app. By adding an individual product app, you enable SSPM to scan more settings for the particular product. To scan more settings for Microsoft Word, Microsoft PowerPoint, and Microsoft Excel, onboard Office 365 - Productivity Apps. Other products in the Office 365 product family have their own tiles on the Applications page, and you can onboard these apps separately.
SSPM gets access to your Office 365 instance through OAuth 2.0 authorization. During the onboarding process, you are prompted to log in to Office 365 and to grant SSPM the access it requires.
To onboard your Office 365 instance, you complete the following actions:
  • Identify the Account for Granting SSPM Access
  • Connect SSPM to Your Office 365 Instance

Identify the Account for Granting SSPM Access

During the onboarding process, SSPM redirects you to log in to Office 365. After you log in, Office 365 will prompt you to grant SSPM the access it needs to your Office 365 instance.
  1. Identify the Office 365 account that you will use to log in to Office 365 during onboarding.
    SSPM will use this account to establish a connection to your Office 365 instance. After SSPM establishes the connection, it will perform an initial configuration scan of your Office 365 instance, and will then run scans at regular intervals.
    When you onboard Office 365, SSPM gives you an option to connect with read-only permissions or with read and write permissions. The onboarding screen lists the API scopes that SSPM requires for each type of scan that it can run. The onboarding screen also lists the API scopes that SSPM requires to perform certain actions on your behalf. For example, if SSPM is granted permission to certain scopes, you can revoke a user's access to a third-party plugin through SSPM. After establishing a connection, SSPM will notify you if it is unable to run certain scans, or complete certain actions, because the account did not have the permissions to grant access to certain scopes.
    Onboarding Office 365 with read-only permissions will enable SSPM to perform configuration scans, risky account scans, and third-party plugin scans.
    Known issue with read-only permissions: If you onboard Office 365 with read-only permissions, and later reauthenticate with read-only permissions, subsequent scans will fail. To resolve this problem, reauthenticate with read and write permissions. If you do not want to allow SSPM write access, you can modify the OAuth 2.0 application that SSPM creates in Microsoft Entra ID (formerly Azure AD). To do this, complete the following steps:
    1. As a Global Administrator, log in to the Azure portal and navigate to the Enterprise applications page. To quickly navigate to this page, enter Enterprise applications in the search field at the top of the page.
    2. On the Enterprise applications page, use the search box to quickly locate the application whose name begins with Prisma Saas SSPM by Palo Alto Networks.
      This application is the OAuth 2.0 application that SSPM created during onboarding, and which currently allows read and write access. The full name of the application will depend on your region.
    3. Select the Prisma Saas SSPM by Palo Alto Networks application and, from the left navigation pane, navigate to its Permissions.
    4. On the Permissions page, click the button to Grant admin consent for your organization.
    5. From the permissions listed on the Admin consent tab, locate the Read and write all applications permission (Application.ReadWrite.All).
    6. For the Read and write all applications permission row, select Revoke Permission.
    Connecting with read and write permissions enables additional SSPM features, including the following features:
    • The ability to revoke a user's access to a third-party plugin.
    • Scans for MFA enrollment issues, which SSPM reports on the Identity Security dashboard.
    • Scans for user sign-in activities, which SSPM displays on the Identity Security dashboard.
    • The ability to force a user out of their current SaaS application sessions from the Identity Security dashboard.
    Required Permissions: To grant SSPM access to either the read-only scopes only or access to read and write scopes, the account must be assigned to the Global Administrator role.
  2. Log out of all Microsoft accounts.
    Logging out of all Microsoft accounts helps ensure that you log in under the correct account during the onboarding process. Some browsers can automatically log you in by using saved credentials. To ensure that the browser does not automatically log you in to the wrong account, you can turn off any automatic log-in option or clear your saved credentials. Alternatively, you can prevent the browser from using saved credentials by opening the Cloud Management Console in an incognito window.

Connect SSPM to Your Office 365 Instance

By adding an Office 365 app in SSPM, you enable SSPM to connect to your Office 365 instance. You must consent to specific permissions when adding the Office 365 app.
  1. From the Add Application page (Posture SecurityApplicationsAdd Application), click the Office 365 tile.
  2. On the Posture Security tab, Add New instance.
  3. Specify whether you want SSPM to connect with Read Permissions only or with Read and Write permissions.
    The onboarding page lists the API scopes that SSPM will access to complete basic scans and to perform advanced scans and actions.
  4. Connect with Office 365.
    SSPM redirects you to the Office 365 login page.
  5. Enter the credentials for the Microsoft account that you identified earlier, and sign in to Office 365.
    Microsoft displays a consent form that details the access permissions that SSPM requires.
  6. Review the consent form and allow the requested permissions.
    SSPM connects to your Office 365 instance, and displays whether it was able to access the API scopes that it requires for its scans and other actions. If SSPM is unable to access necessary scopes, it indicates which scans and actions it will not be able to perform.
xThanks for visiting https://docs.paloaltonetworks.com. To improve your experience when accessing content across our site, please add the domain to the allow list on your ad blocker application.