Connector setup
Microsoft connector (delegated mode)
Set up delegated Microsoft ingestion, understand consent scopes, and validate both Graph and Office 365 lanes.
Updated May 5, 2026 | 10 min
When to use delegated mode
Use delegated mode when customer security admins can complete interactive consent and want the connector tied to a named administrator context.
ITDR stores delegated credentials and can run scheduled ingestion as long as refresh tokens and consent remain valid.
Step-by-step setup
- Sign in with a tenant-admin, partner-admin, or super-admin account and switch to the target tenant.
- Open Connectors and start Microsoft delegated authorization.
- Complete Microsoft consent prompt. ITDR stores delegated refresh credentials and marks connector status active or pending setup.
- Run Office 365 delegated authorization from the same connector to enable the Office 365 Management lane.
- Use Sync now to queue an immediate import and confirm Graph + O365 lane health in the connector detail panel.
Customer prerequisites
Admin account
A Microsoft admin who can consent to Graph delegated permissions for the customer tenant.
Target tenant
The ITDR tenant selected before starting authorization. Partner admins should switch tenants first.
Consent expectation
The admin should expect Microsoft to show identity, audit, risk, security, and response-action scopes.
O365 lane owner
Decide whether the same admin will authorize the Office 365 Management lane after Graph authorization.
Consent scopes requested
ITDR delegated OAuth requests the platform scope set configured by backend environment. Scope groups below reflect the current baseline.
Sign-in and tenant identity reads
Detection and risk telemetry
Incident response and remediation actions
Reserved for future remediation features
These scopes appear on the Microsoft admin-consent prompt because the platform requests them today, but no live code path exercises them yet. They are pre-consented so future features — risky-event dismissal, risky-user confirm-compromised, Defender incident state writes, security action submissions — will not require re-prompting customers. If your organization prefers strict least-privilege at consent time, the platform operator can remove them from MICROSOFT_SCOPES and re-request them only when the corresponding feature ships.
Post-setup validation
- Connector health badge should show Healthy or Synced with warnings, not Reauthorization required.
- Token lanes section should show Graph lane healthy and O365 lane authorized (or explain its degradation explicitly).
- Graph preview should return organization and sample users.
- Secure Score page should load if SecurityEvents permissions are consented.
Troubleshooting
- If connector status becomes reauthorization_required, rerun delegated authorization and confirm refresh-token consent was not revoked.
- If O365 lane is not connected, run the dedicated O365 delegated authorization button for that connector.
- If actions such as disable user or revoke sessions are blocked, check the connector required scopes shown in incidents/action capability responses.
Customer authorization script
Send this short sequence to customer admins who will complete the Microsoft consent step themselves.
Sign in to ITDR with an admin account for the correct customer tenant.
Open Connectors -> Microsoft delegated authorization.
Complete Microsoft consent using the customer Microsoft admin account.
Return to ITDR and verify the connector is active or pending setup.
Open the connector and run Office 365 delegated authorization if mailbox/audit activity is required.
Click Sync now and wait for Graph and O365 lanes to report healthy or synced with warnings.