Connect Microsoft 365

This guide walks a Microsoft 365 Global Administrator through connecting Helios via the Microsoft Graph API.

Note

You need a Global Administrator (or Privileged Role Administrator) to grant tenant-wide admin consent for the Graph permissions below.

Overview

Helios connects to Microsoft 365 with two permission types:

• Delegated permissions — used during the interactive admin sign-in for mailbox protection (read/move mail).
• Application permissions — used by the background SaaS Security scanner (Teams, SharePoint, governance) that runs without a signed-in user.

Part 1 — Register the app in Entra ID

1. Go to portal.azure.com → Microsoft Entra ID → App registrations → New registration.

2. Name: Himaya Helios.

3. Supported account types: Accounts in any organizational directory (multi-tenant).

4. Redirect URI: platform Web, value:

   https://app.himaya.ai/api/onboarding/callback/m365

5. Click Register, then copy the Application (client) ID and Directory (tenant) ID.

6. Go to Certificates & secrets → New client secret, copy the Value immediately (it’s shown only once).

Part 2 — Add Graph permissions

Delegated permissions (mailbox protection)

Under API permissions → Add a permission → Microsoft Graph → Delegated permissions, add:

Permission	Purpose
openid, email, profile, offline_access	Sign-in + refresh tokens
User.Read, User.Read.All	Admin profile + user directory
Mail.Read, Mail.ReadWrite	Read mail; move to quarantine
MailboxSettings.Read	Read inbox rules (posture)
Group.Read.All	Resolve group membership

Application permissions (SaaS Security scanner)

Only needed if you use the SaaS Security / posture features. Under Application permissions, add:

Permission	Powers
User.Read.All	External / guest user enumeration
Group.Read.All	Teams membership
Sites.Read.All	SharePoint sites & files
Files.Read.All	File content for DLP scanning
ChannelMessage.Read.All	Teams channel messages
Directory.Read.All	Tenant directory
Policy.Read.All	Conditional Access gap detection
AuditLog.Read.All	Risky / blocked sign-ins
AppCatalog.Read.All	Teams + tenant app catalog
TeamsAppInstallation.ReadForTeam.All	Per-team installed apps
InformationProtectionPolicy.Read.All	DLP / sensitivity labels
IdentityRiskyUser.Read.All	Risky users feed
IdentityRiskEvent.Read.All	Risk events
SecurityEvents.Read.All	Security alerts

Caution

Azure only grants permissions that are declared in the app registration and admin-consented. If any permission name is invalid, Azure rejects the entire consent request with AADSTS650053 — nothing gets granted. Add the names exactly as written above.

1. After adding all permissions, click Grant admin consent for <tenant>.
2. Confirm every row shows a green Granted status.

Part 3 — Connect in Helios

1. In Helios, go to Settings → Integrations and click Connect Microsoft 365.
2. Sign in as the Global Administrator and approve consent.
3. You’re redirected back; the integration shows Active and mailbox discovery begins.

Backend configuration (self-hosted)

If you operate your own Helios backend, set these environment variables from Part 1:

M365_CLIENT_ID=<Application (client) ID>
M365_CLIENT_SECRET=<Client secret value>
M365_TENANT_ID=common          # or your specific tenant GUID
M365_REDIRECT_URI=https://app.himaya.ai/api/onboarding/callback/m365

Note

Mailbox-level forwarding removal (Set-Mailbox -ForwardingSmtpAddress $null) cannot be done through Graph. Helios removes malicious inbox-rule forwards automatically, but a mailbox-level forward must be cleared in the Exchange admin center.

Next steps

Deploy the Outlook Add-in

One-click phishing reporting — see Report Add-ons.

Set up policies

Configure automated actions in Policies.