Configure Microsoft Defender for Office 365 integration

  • Versão de lançamento: Australia
  • Atualizado 12 de mar. de 2026
  • 1 min. de leitura

    • Gain valuable insights into phishing simulation metrics directly within the Cybersecurity Executive Dashboard through seamless integration with Microsoft Defender for Office 365.

    Antes de Iniciar

    Role required: sn_sec_phish_msatk.ms_admin

    Por Que e Quando Desempenhar Esta Tarefa

    To learn more about simulating a phishing attack and setting up a tenant, see:

    Procedimento

    1. Navigate to All > Microsoft Attack Integration > Microsoft Attack Configurations.
    2. Select New.
    3. On the form, fill in the details:
      Tabela 1. Microsoft Attack Configuration form
      Field Description
      Integration Instance Name of the integration instance. Select the integration instance using the Lookup icon.
      Tenant ID Tenant ID of the application created on the Microsoft Azure portal.
      Client ID Client ID of the application created on the Microsoft Azure portal.
      Client Secret Client secret of the application created on the Microsoft Azure portal.
      Bookmark Date from which the simulations must be fetched.
      Token Url Base URL from where the token is created to access the Microsoft Simulations API.
      All Simulation Url Base URL of the Microsoft Simulations API.
      1. Select New if no integration instance is available.
      2. On the form, fill in the details:
        Tabela 2. Integration Instance form
        Field Description
        Name Name of the integration instance.
        Application Name of the application (Microsoft Defender for Office 365).
        Integration Third-party integration reference (Microsoft Attack Integration).
        Active Default is activated (selected). If cleared, the instance isn't active.
        Description Short description of the integration instance.
    4. Select Submit.
    5. Navigate to All > Security Simulation and Training > Integrations.
    6. Select Microsoft Attack integration.
    7. Select Execute Now to execute and collect data from Microsoft.