Monitor Microsoft 365 permissions across all customers

Azure App Setup (automated)

Connect to the customer's Microsoft tenant, then create a dedicated scan app automatically.

• Click Connect Microsoft and approve admin consent.
• Created scan app receives SharePoint Sites.FullControl.All with admin consent.
• For mailbox scanning, the Exchange.ManageAsApp permission and Exchange Administrator Entra role must be added manually after creation — see the Enable mailbox scanning section below.

Azure App Setup (manual)

Create a dedicated Azure app registration in the customer's tenant.

1. Open Azure Portal → Entra ID → App registrations → New registration.
2. Pick a name (e.g. Clearview Scan App), select Single tenant, click Register.
3. Copy Directory (tenant) ID and Application (client) ID.
4. For SharePoint: API permissions → Add a permission → SharePoint → Application permissions, select Sites.FullControl.All, then click Grant admin consent.
5. For group resolution (recommended): also add Microsoft Graph → Application permissions → Group.Read.All and grant admin consent. This lets Clearview expand Microsoft 365 / Azure AD security groups to their members and owners during the Resolve groups action. Without it, M365 group entries are kept as a single line.
6. The primary domain is the tenant's default Microsoft 365 domain — typically <tenantname>.onmicrosoft.com. Find it in Microsoft 365 admin center → Settings → Domains (the Default entry).

Enable mailbox scanning (Exchange Online)

Mailbox scanning needs additional permissions on the scan app, on top of the SharePoint setup. Skip this section if the tenant only needs SharePoint scans.

1. Add the API permission. Azure Portal → Entra ID → App registrations → [your scan app] → API permissions → Add a permission → APIs my organization uses. Search for Office 365 Exchange Online, choose Application permissions and tick Exchange.ManageAsApp. Click Add permissions.
2. Grant admin consent. Still on the API permissions page, click Grant admin consent for <tenant>. Verify the status column shows Granted for <tenant>.
3. Assign the Exchange Administrator role. Entra ID → Roles and administrators → search Exchange Administrator → click the role → Add assignments → search the scan app by name (you'll need to switch the picker to include Service principals / Apps) → select it and confirm. This role grants the app the right to read mailbox permissions; it cannot be granted via Microsoft Graph and must be done in the portal.
4. Generate a certificate. Save the tenant first (this section's form), then use the Certificate button in the Tenants table to generate a self-signed RSA-2048 key. The public PEM appears in a panel — click Download .cer.
5. Upload the certificate to Azure. Back in the scan app, go to Certificates & secrets → Certificates → Upload certificate, pick the downloaded .cer file, and confirm. Azure shows the SHA-1 thumbprint — it must match the one shown in the Tenants table.
6. Fill in the Primary Domain field on the tenant form (e.g. contoso.onmicrosoft.com). Clearview uses this for Connect-ExchangeOnline -Organization and to auto-fill the Mailbox scan form.
7. Test the connection. Run a Scan all mailboxes job for this tenant; preflight on the first target validates that authentication works end-to-end.

Exchange Online does not support client-secret app-only authentication. Mailbox scans require a certificate. The same certificate is reused for SharePoint scans, so generating it once is enough.