Getting Started

Access Defender Pro connects to your Microsoft 365 tenant using read-only Graph API permissions. No agents, no software installation, and no changes to your production environment.

✓
Access Defender Pro operates in strict read-only mode. It never creates, modifies, or deletes any data in your Microsoft 365 environment.

Setup takes approximately 10–15 minutes and requires a Global Administrator account. Once connected, your first permission snapshot will be available within the hour.

Prerequisites

Before you begin, make sure you have the following:

  • Microsoft 365 Business Standard or higher — required for SharePoint Online and Unified Audit Log access.
  • Global Administrator account — required to register an Azure app and grant tenant-wide admin consent.
  • Azure Active Directory (Entra ID) access — to create the App Registration.
  • Unified Audit Log enabled — must be turned on in your tenant (see Enable Audit Logs below).
⚠
Microsoft 365 Developer (E5) tenants: Unified Audit Log is disabled by default. You must enable it manually via PowerShell before Access Defender Pro can collect audit events.

Azure App Registration

Access Defender Pro requires an Azure App Registration to authenticate with your Microsoft 365 tenant using the client credentials flow (no user login required after setup).

1

Open Azure Portal

Sign in with your Global Administrator account and navigate to:

portal.azure.com → Microsoft Entra ID → App registrations
2

Create New Registration

Click New registration and fill in the following:

  • Name: Access Defender Pro (or any name you prefer)
  • Supported account types: Accounts in this organizational directory only
  • Redirect URI: Leave blank

Click Register.

3

Note Your Application IDs

On the Overview page, copy and save these values — you will need them during configuration:

  • Application (client) ID
  • Directory (tenant) ID
4

Create a Client Secret

Navigate to:

Certificates & secrets → Client secrets → New client secret

Set a description (e.g. "ADP Secret") and choose an expiry. Click Add.

⚠
Copy the secret value immediately. It will not be shown again after you leave this page. Store it securely.
5

Add API Permissions

Navigate to:

API permissions → Add a permission → Microsoft Graph → Application permissions

Add all permissions listed in the Required Permissions section below. Then also add:

Add a permission → Office 365 Management APIs → Application permissions → ActivityFeed.Read
6

Grant Admin Consent

After adding all permissions, click:

Grant admin consent for [Your Organization]

Confirm by clicking Yes. All permissions should show a green checkmark with "Granted for [Your Organization]".

✓
Admin consent must be granted by a Global Administrator. Without it, Access Defender Pro cannot read tenant-wide data.

Required Permissions

Access Defender Pro requires the following Microsoft Graph application permissions. All are read-only.

Permission Type Purpose
Sites.Read.All Application Discover and read all SharePoint site collections, document libraries, and folder structures.
Sites.FullControl.All Application Read permission assignments at all levels including broken inheritance folders. Despite the name, Access Defender Pro uses this in read-only mode only.
Directory.Read.All Application Read users, security groups, and organizational structure to resolve effective permissions.
User.Read.All Application Read user profiles and display names for permission mapping and forensic reports.
AuditLog.Read.All Application Read Azure AD audit logs for anomaly detection and sign-in analysis.
ActivityFeed.Read Application Subscribe to and read M365 Unified Audit Log events including SharePoint file activity, sharing events, and admin actions. Requires Office 365 Management APIs.
ℹ
Sites.FullControl.All is required to read permissions on folders with broken inheritance. Without it, only top-level site permissions are accessible via Graph API.

Enable Unified Audit Log

The Unified Audit Log must be enabled in your Microsoft 365 tenant for Access Defender Pro to collect file activity events. In most production tenants it is already enabled — but developer and trial tenants often have it disabled.

Check current status

Run the following PowerShell commands to check and enable audit logging:

PowerShell — Exchange Online
# Install module if needed
Install-Module -Name ExchangeOnlineManagement

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.onmicrosoft.com

# Check current status
Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled

# Enable if false
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
⚠
After enabling, it can take up to 60 minutes for the first audit events to appear. Access Defender Pro will begin collecting events automatically once the subscription is confirmed.

Verify the subscription

Once Access Defender Pro is running, it will automatically start an Audit.SharePoint subscription via the Office 365 Management API. You can verify this is active in the Access Defender Pro dashboard under Engine & Connectivity Status → M365 Audit API.

✓
A status of ACTIVE on the M365 Audit API card means the subscription is running and events are being collected in real time.

Verification Checklist

Once your tenant is configured, use this checklist to confirm everything is set up correctly before running your first scan.

🎉
Once all boxes are checked, your Access Defender Pro environment is fully operational. Navigate to the Dashboard to view your first security findings.