Skip to main content
Flarehawk ingests Microsoft Entra sign-in and directory audit logs plus Microsoft 365 unified and Exchange mailbox audit activity through one tenant connection. You do not create an app registration or copy client secrets — a Global Administrator grants consent to the central Flarehawk multi-tenant application, and Flarehawk polls Microsoft Graph and the Office 365 Management Activity API on your behalf.
The Microsoft 365 connector is in beta. Look for the Beta badge on the connection picker and provider surfaces. Report issues or request early access for additional tenants via [email protected].

​
How log delivery works

Flarehawk polls Microsoft APIs on a schedule and streams normalized events into the same detection and investigation pipeline as Cloudflare and Fastly telemetry: Detections include per-principal statistical rules (failed sign-ins, MFA spikes, risky sign-ins, mailbox attachment access, and admin changes). Selected Graph remediation actions (for example session revocation) are available from incident workflows where your tenant policy allows them.

​
Prerequisites

  • An active Flarehawk organization. See the quickstart if you have not signed up yet.
  • A Microsoft Entra ID tenant with a Global Administrator who can grant admin consent.
  • For Unified Audit Log and Mailbox Audit Log: unified audit logging enabled in Microsoft Purview (typically Microsoft 365 E3/E5 or equivalent licensing).

​
Create the Microsoft connection

1

Open the Connections page

In the Flarehawk dashboard, go to Manage → Connections and click Add Connection. Select Microsoft 365 & Entra ID (shown with a Beta badge).
2

Connect with Microsoft

Click Connect with Microsoft and sign in as a Global Administrator for the tenant you want to monitor. Review the read-only permissions and grant consent. Flarehawk stores only your tenant id — no client secrets or redirect URLs are required in your directory.
3

Select log sources

Choose which telemetry to ingest. All four sources authenticate with the same consent grant:
  • Sign-in Logs — recommended for identity threat detection.
  • Audit Logs — directory and configuration change monitoring.
  • Unified Audit Log — broad M365 workload activity (requires Purview audit logging).
  • Mailbox Audit Log — Exchange mailbox operations (requires Purview audit logging).
4

Verify ingestion

After the connection is active, generate sign-in or audit activity in your tenant. Within a few minutes, events appear under Monitor → Logs and on the Microsoft analytics dashboards (Mailbox and Audit). Connection status should show recent poll activity and per-dataset ingest health on the connection detail page.

​
Enable Microsoft 365 audit logging

The unified and mailbox audit sources require audit recording to be on in your tenant:
  1. Open the Microsoft Purview portal → Audit.
  2. If prompted, click Start recording user and admin activity.
Without this step, Entra sign-in and directory audit logs still ingest, but M365 unified and mailbox datasets remain empty.

​
Analytics and detections

  • Analytics — /analytics/microsoft/mailbox and /analytics/microsoft/audit (legacy flat paths redirect automatically).
  • Detections — statistical rules evaluate per principal within your tenant connection; baselines do not bleed across organizations or connections.
  • Remediation — Graph-backed response actions appear on eligible incidents; approval and audit requirements match your existing Flarehawk remediation settings.

​
Security and tenancy

  • One tenant per connection — Flarehawk blocks attaching a Microsoft tenant that is already linked to another Flarehawk organization.
  • Certificate-based app auth — the central Flarehawk Entra application uses certificate credentials stored in Flarehawk infrastructure; your tenant only grants consent.
  • Reconnect prompts — if Microsoft revokes or expires tokens, the connection surfaces a reconnect state instead of failing silently.

​
Troubleshooting

For operator-side detection tuning on staging, see docs/operations/microsoft-detection-testing.md in the repository.