Microsoft 365 (unified): setup

Last updated:

Microsoft 365 (unified): setup

The Microsoft 365 (unified) integration replaces the standalone Entra ID and Intune providers. One Azure AD app registration grants Chorum the surface it needs across the customer's whole Microsoft estate: user provisioning, licence assignment, group membership, mailbox forwarding, Intune device inventory + compliance, and risky-user / risky sign-in alerts.

Existing Entra ID and Intune integrations keep working. New customers should use Microsoft 365 (unified). The two legacy providers no longer appear in the new-integration picker.

Prerequisites

  • Global Admin (or equivalent privileged role) on the customer's Microsoft 365 tenant. You need this to grant admin consent for application permissions.
  • Customer holds the licences the feature surface requires. Intune needs Microsoft 365 Business Premium / E3 / E5 or Enterprise Mobility + Security. Risky-user signals need any Entra ID Premium tier (P1 or P2).

Step 1: Register the app

  1. Sign in to entra.microsoft.com as an admin of the customer's tenant.
  2. Go to Applications > App registrations > New registration.
  3. Name it Chorum MSP Integration (anything is fine). Leave the redirect URI blank. Click Register.
  4. On the Overview page, copy:
    • Application (client) ID: a GUID.
    • Directory (tenant) ID: a GUID.

Step 2: Create a client secret

  1. Inside the app, open Certificates & secrets > Client secrets > New client secret.
  2. Description: Chorum. Expiry: pick the longest available (typically 24 months).
  3. Click Add.
  4. Copy the Value column immediately. This is the only time it is shown. The Secret ID column is not what we need.

Step 3: Grant Graph permissions

  1. Open API permissions > Add a permission > Microsoft Graph > Application permissions.
  2. Add each of the permissions in the list below. Use the search box, tick each box, click Add permissions.
  3. After all are added, click Grant admin consent for <tenant> at the top of the permissions list. Confirm.
  4. Every row should now show Granted for <tenant> with a green tick. If any row fails, the customer's tenant probably blocks that scope through Conditional Access; raise it with their admin.

Permissions list

The wizard inside Chorum has a "Copy permission list" button that produces this same set.

  • User.Read.All — list users for action pickers
  • Group.Read.All — list groups
  • Directory.Read.All — tenant metadata, domain list
  • Organization.Read.All — SKU / licence catalogue
  • User.ReadWrite.All — create / update / disable users, reset passwords, revoke sessions, assign licences
  • Group.ReadWrite.All — add / remove group members
  • IdentityRiskyUser.Read.All — surface risky users in the alert queue
  • AuditLog.Read.All — sign-in logs, used for suspicious-sign-in alerts
  • DeviceManagementManagedDevices.Read.All — Intune device inventory
  • DeviceManagementConfiguration.Read.All — compliance policy + status
  • DeviceManagementApps.Read.All — installed apps reporting
  • MailboxSettings.ReadWrite — mailbox forwarding rules

If any single scope is missing, only the dependent feature degrades. The integration still works for everything else and the missing scope is named in the connection-test error.

Step 4: Enter the credentials in Chorum

  1. In Chorum, open Helpdesk > Settings > Integrations > New integration.
  2. Pick Microsoft 365 (unified). Pick the customer. Label it something like <Customer> M365.
  3. On the credentials step, paste:
    • Directory (tenant) ID: the GUID from Step 1.
    • Application (client) ID: the GUID from Step 1.
    • Client secret value: the secret from Step 2.
  4. Click Next. The wizard saves the integration and runs a connection test.
  5. The test should report "Entra + Intune scopes verified". If either fails, the error names the missing scope.
  6. Click Finish. The integration appears on the integrations list.

What runs automatically

Once the integration is enabled:

  • Every 5 minutes: alert sync. Pulls risky users, suspicious sign-ins and Intune compliance violations. New alerts land in /helpdesk/alerts.
  • Every 30 minutes: directory sync. Refreshes user snapshots, licence assignments and managed-device inventory in the CMDB.
  • You can trigger either ahead of schedule from the integration row in Settings > Integrations (Sync alerts, Sync devices, Test alert).

What actions are available

From a ticket detail page, the M365 action panel can:

  • Create a new user (with optional licence assignment as part of the same action).
  • Disable or enable a user.
  • Reset a user's password (with forced change on next sign-in).
  • Revoke a user's sign-in sessions (for incident response when a credential is suspected compromised).
  • Add or remove a user from a group.
  • Assign or remove a licence (Office E3, Business Premium, Intune standalone, etc.).
  • Set mailbox forwarding for a leaver.
  • Trigger an Intune sync, lock or wipe on a managed device.

Every action is audited in the IntegrationAction table with who, when, target, input and outcome. The audit row is also surfaced on the originating ticket activity feed.

Permissions: what we deliberately did not ask for

We do not request Mail.ReadWrite, Files.ReadWrite.All, Sites.FullControl.All or any other broad read-write scope on user data. The integration writes only to directory objects (users, groups, mailbox settings) and managed devices. If a future feature needs a broader scope it will go through a new wizard step that lists the addition explicitly.

Rotating the client secret

  1. In the customer's Azure portal, open the app registration's Certificates & secrets.
  2. Add a new secret. Copy the Value.
  3. In Chorum, open the integration's edit screen and paste the new secret. Save.
  4. Remove the old secret in Azure.
  5. Run a manual Sync now to confirm the new secret is in use.

Troubleshooting

  • Connection test reports "Entra: 403": the app registration is missing one of the Entra-scope permissions, or admin consent was not granted after the permission was added. Re-check the API permissions page and click Grant admin consent again.
  • Connection test reports "Intune: 403": the customer probably does not hold an Intune-eligible licence, or the device-management scopes were not granted. Verify the licence first, then re-check the permissions.
  • Alerts come through but devices stay at zero: the customer has Entra licences but no Intune. That is fine. Sync still runs but skips devices.
  • An action returns "Insufficient privileges": the action is a write-side call (e.g. licence assign) and the corresponding ReadWrite scope is missing. Add it in Azure and grant consent.
  • Alerts never appear: confirm the integration is enabled in Chorum, then run Sync alerts manually. If it reports zero, the customer genuinely has no risky users or compliance violations open right now, which is the desired steady state.

Migrating from legacy Entra ID / Intune integrations

If a customer already has the legacy Entra ID and Intune integrations side by side, you can migrate to Microsoft 365 (unified) in one shot:

  1. Note the existing app-registration's client ID, tenant ID and secret expiry from the legacy integration.
  2. In Azure, add any missing permissions from the unified list to the existing app. Grant consent.
  3. In Chorum, create a new Microsoft 365 (unified) integration against the same customer using the same credentials.
  4. Verify the new integration works (Sync now, Test alert).
  5. Disable the old Entra ID and Intune integrations so they stop appearing in the integrations list. They keep their historical action audit trail.

Do not delete the legacy integrations. The IntegrationAction audit log links to them and the audit trail must remain intact for compliance.