Integrate Microsoft Office 365 with Zscaler MDR

Note: In addition to setting up this Microsoft Office 365 integration, please also configure the Entra ID integration and Microsoft Graph integration to ensure you have the most complete and accurate data in Zscaler MDR.

Zscaler MDR monitors your Office 365 environment by integrating with the Office 365 Management API, which sources data from the Microsoft Unified Audit Log. The Unified Audit Log (UAL) is an aggregation of audited activities that occur within your Microsoft 365 environment. By connecting your Unified Audit Log to Zscaler MDR as an external service, Zscaler MDR will have the enhanced ability to analyze and detect threats related to email events, user sign-ins, and more, supplementing the investigation of your Microsoft email- and identity-based alerts. Supporting artifacts from the Unified Audit Log will appear alongside endpoint activity in your threat timeline where applicable.

Zscaler MDR collects and stores all event types from the Unified Audit Log for investigations and hunting, and we pay special attention to the following logs for detection purposes:

• EmailRuleModification

• MailboxSettingsModification

• LogonAttempt

• MailboxAccessDelegated

• MailboxFolderPermissions

Prerequisites

Before you start the Microsoft Office 365 integration, please make sure the following requirements are met:

• You’re a Global Administrator user

• You have an active Microsoft subscription that includes Microsoft Office 365. To check if your subscription plan includes Office 365, refer to Microsoft's Subscription Matrix.

• You consent to granting Zscaler MDR permissions to your Microsoft environment. For more information on which permissions we require, see Permission Requirements for Microsoft.

• You have audit logging turned on for your organization

  Note

  We recommend that you have the following operations turned on in your mailbox audit log section in Office 365 in addition to the operations enabled by default:

  • Move

  • SearchQueryInitiated

1 Zscaler MDR | Add the Integration

1. In the Zscaler MDR portal, go to the Integrations page, then click Add Integration.
   

2. On the Add integration dialog, search for Microsoft Office 365, then click Configure.
   

2 Zscaler MDR / Microsoft 365 | Enable Auditing and Grant Permissions

Before configuring the integration, you’ll need to enable auditing and grant Zscaler MDR permissions to access your Office 365 data:

1. Verify that you have auditing enabled for your organization by following the steps detailed here.

2. Check the box indicating that auditing is turned on and Zscaler MDR has access to your Office 365 account.
   

3. Grant Zscaler MDR permissions:

   1. Navigate to this URL, and then log in to your Global Administrator account.

   2. Approve the permissions requested by Zscaler MDR + Office365.

3 Zscaler MDR | Provide Your Microsoft 365 Tenant ID

1. Find and copy your Microsoft 365 Tenant ID. To find your ID, follow the steps in Find your Microsoft 365 tenant ID.

2. On the Zscaler MDR integration page, paste it into the Microsoft Office365 Tenant ID field.

   

4 Zscaler MDR | Customize How This Data Is Retained

[OPTIONAL] If you’re subscribed to the Zscaler MDR Security Data Lake managed storage solution, you can choose to copy the telemetry generated by the integration to long-term storage for later query or retrieval.

1. Check the Store in the Security Data Lake box.

2. Enter your desired data retention period in days. The maximum is 1095 days (three years).

3. [OPTIONAL] Click Advanced Configuration to exclude selected Entra ID identity groups from being counted as monitored identities.

   Tip

   When marking a large number of groups as out-of-scope, you can save time by designating a parent group as out-of-scope — this will automatically apply to all sub-groups nested within it, without needing to mark each one individually.

   Note

   Excluded groups and identities may still be included in Investigations and Threats, but will not be included in the MDR Identities count on the License Usage page.

   

4. Click Save.

FAQ