Microsoft 365 (unified) integration

Microsoft 365 (unified) integration

Recommended for new customers. One Azure AD app registration covers:

• Users — read directory + write (create / disable / reset password / license assign)
• Sign-ins + Audit logs — feeds the SOC alert queue (failed sign-ins, CA-blocked, high-risk)
• Licensing — subscribed SKUs and per-user license assignment
• Devices (Intune) — read inventory, sync, lock, wipe, retire, locate, reboot
• Mailbox — set forwarding / out-of-office for offboarding
• Conditional Access — read + edit policies

Prerequisites

• Global Administrator on the customer's Microsoft 365 tenant
• Customer has at least one of: M365 Business Premium, E3, E5, EMS — for Intune actions
• Entra ID P1 — for risky users + sign-in log alerts (P2 for richer signals)

Quick install (PowerShell)

The fastest route — script registers the app, requests every Graph scope, generates a client secret, prints the IDs:

iwr https://YOUR-CHORUM-HOST/scripts/install-microsoft365-integration.ps1 -OutFile chorum-m365.ps1
.\chorum-m365.ps1

Save the JSON output. Open the consent URL in a browser, click Grant admin consent, then paste the three values into the Chorum wizard.

Manual install

1. Sign in to entra.microsoft.com as Global Admin of the customer's tenant
2. Applications → App registrations → New registration. Name it Chorum Integration. Single tenant. No redirect URI.
3. Copy the Application (client) ID and Directory (tenant) ID
4. Certificates & secrets → New client secret. 24-month expiry. Copy the Value immediately
5. API permissions → Add permission → Microsoft Graph → Application permissions, add all 13:

- User.ReadWrite.All - Group.ReadWrite.All - Directory.Read.All - Organization.Read.All - AuditLog.Read.All - IdentityRiskyUser.Read.All - MailboxSettings.ReadWrite - DeviceManagementManagedDevices.Read.All - DeviceManagementManagedDevices.PrivilegedOperations.All - DeviceManagementConfiguration.Read.All - DeviceManagementApps.Read.All - Policy.Read.All - Policy.ReadWrite.ConditionalAccess

1. Grant admin consent for {customer}. All rows must show "Granted"
2. In Chorum, go to /helpdesk/settings/integrations/new → Microsoft 365, paste the three values

What syncs and where it lands

Source	Destination	Frequency
Users + licences	Customer detail → Users / Licences tabs	Every 30 min
Devices (Intune)	Customer detail → Assets / Devices	Every 30 min
Risky users (high)	SOC alerts	Every 5 min
Sign-in failures (CA-blocked, high-risk)	SOC alerts	Every 5 min
Intune compliance violations	SOC alerts	Every 5 min

Actions available

From the customer detail Users tab → ... menu:

• Disable / Enable account
• Reset password (forces change next sign-in)
• Revoke all sign-in sessions

Programmatic equivalents (/api/helpdesk/integrations/{id}/m365/...):

• create user, update user, delete, assign / remove license, group membership add / remove, mailbox forwarding

Intune device actions (/api/helpdesk/integrations/{id}/intune/devices/{deviceId}/...):

• sync, lock, wipe, retire, locate, reboot

Troubleshooting

• 403 on every action — admin consent wasn't granted. Re-open the consent URL.
• Insufficient permissions error — a specific scope missing from the app reg. Add it, grant consent, re-test.
• Sign-in log sync warns "tenant may lack P1" — Entra ID P1 not licensed. Risky-user / sign-in features stay disabled but everything else still works.
• Intune actions 404 — the device may have been retired in Intune; refresh the device list.

Audit trail

Every privileged action (disable, wipe, license assign, etc.) is logged with the staff user, target, payload (sanitised), result, and ticket link if performed during ticket resolution. Customer tenants emit to stdout only by default — set INTEGRATION_AUDIT_DB=true on the platform tenant for permanent DB rows.