Connect Microsoft 365

The simplest way is admin consent: a Microsoft administrator accepts, on Microsoft's official screen, the read permissions Sorvek requests, and the connectors are created automatically, with no secret to copy. If your policy requires the collection app to belong to you, create your own app registration instead (BYO option).

Before you start

You need two kinds of access, sometimes held by the same person:

• In Sorvek: the Administrator role in your organization. See Roles and access.
• At Microsoft: a member account in your tenant with the Global Administrator or Privileged Role Administrator role, active.

Option 1: admin consent (recommended)

1. In Sorvek, on the Overview, click Connect Microsoft 365. You can also go through Settings > Data sources > Add a source, then choose the Microsoft Admin Consent option.
2. On the Microsoft 365 connection page, check the Communication email: the email sent when the first scan ends and the monthly report go to this address (a shared mailbox works). See Alerts in Teams, by email and in Jira.
3. Click Connect Microsoft. You are redirected to Microsoft's consent screen (login.microsoftonline.com).
4. Sign in with your administrator account, read the list of permissions shown by Microsoft, then click "Accept".
5. Microsoft asks you to sign in a second time, with the same account. This sign-in proves that you are an administrator of the tenant; it does not request any additional permission.
6. You return to Sorvek on the Microsoft connected message. Click View the discovery.

What happens next

• Sorvek creates three connectors (Entra ID, Microsoft 365 email, Microsoft Defender), listed under Connectors provisioned automatically.
• A data source is created for this tenant. If no other source is active, it becomes the active source.
• If your organization has never been scanned and the SaaS Discovery module is active, the first scan starts right away. What follows is described in Your first week.

If the connection fails

Nothing is created, and the page shows the reason. The most common cases:

• Administrator role not activated: neither of the two required roles is active on the account.
• Guest account or Different tenant: the second sign-in was not done with a member account of the same tenant.
• Consent canceled: the consent or the verification sign-in was declined.
• Tenant already linked: this tenant already belongs to another Sorvek organization. Only the Sorvek team can link it to yours: write to contact@sorvek.com.

Option 2: your own app registration (BYO)

The collection app then belongs to your tenant, and you manage its secret.

1. Open Settings > Data sources > Add a source, then choose the Microsoft Manual (BYO) option.
2. In 1. Select the modules, check at least Entra ID and Microsoft 365 Mail. Entra ID is required for the nightly scan; Microsoft 365 Mail is used for email analysis and for the Run a scan button.
3. In 2. Create the app in Entra + add these permissions, click Open the Entra portal and create an app registration in your own tenant.
4. In its API permissions, add each permission from the Sorvek table, as type Application, then grant admin consent.
5. Create a client secret and copy its value (the Value column, not the Secret ID).
6. In 3. Create a client secret then fill in here, fill in Name (label), Microsoft Tenant ID, Application (client) ID and Client secret.
7. Click Test & Save. Sorvek tests each connector with a real read call and shows the Result by connector.
8. Click Back to list, then Enable next to the new source.

Before saving, Sorvek checks that the token really comes from the tenant you entered, that the app belongs to it (with Directory.Read.All, requested even without Entra ID) and that this tenant is not linked to another Sorvek organization. A connector that fails is not created; if none passes, nothing is saved. The secret is stored encrypted.

Check or remove access

The Permissions button of each source, in Data sources, shows what is granted; the details are in Requested permissions. To suspend collection or remove Sorvek's access at Microsoft, see Disconnect Sorvek.