Integration: Kaseya MDR and Microsoft 365

This article explains how to connect a customer’s Microsoft 365 tenant to Kaseya MDR so Microsoft identity and activity telemetry can be associated with the correct organization and made available to support MDR investigations.

Once connected, Microsoft‑sourced activity can provide additional context within MDR investigations.

Use this article to

  • Connect Microsoft 365 for a specific organization

  • Understand what the connection establishes (telemetry association and visibility)

  • Validate that the connection is working

    Scope note: This article does not define which alerts will fire, which specific event types are guaranteed, or which response actions will occur. Detection and response behavior depends on MDR service configuration, enabled capabilities, and Microsoft data availability.

    Microsoft 365 telemetry is used to support MDR investigations and detections where applicable. It does not replace endpoint or infrastructure monitoring performed by Kaseya MDR.

How the Microsoft 365 connection works in Kaseya MDR

Microsoft 365 is typically connected per customer organization (per tenant). Once connected, the resulting telemetry is associated with that organization and can be used as supporting context during MDR investigations.

Microsoft 365 integrations are customer‑owned connections, unlike MSP‑level integrations such as certain endpoint security tools. Each Microsoft tenant is authorized and managed independently at the organization level.

Requirements

Before starting, ensure you have the following:

  • Tenant administrative access: You need an account with sufficient administrative privileges in the customer’s Microsoft tenant to grant the requested permissions during the consent flow.

  • Browser access: The connection flow uses a Microsoft sign‑in/consent window. Browser pop‑ups must be allowed.

  • Licensing note: Core Microsoft identity and activity monitoring does not require Microsoft Entra ID P2. Availability of additional Microsoft‑provided risk or premium data may depend on the tenant’s licensing.

  • Global Administrator credentials: Use a Global Administrator account in the customer tenant to complete the consent process.

  • Note on CSP accounts: Do not use a master CSP (Cloud Solution Provider) partner account to establish the connection, as this can lead to permission issues.

  • Recommended licensing: Microsoft Entra ID P1 (formerly Azure AD P1) is recommended to unlock additional MFA and self‑service password reset (SSPR) reporting visibility.

Connecting Microsoft 365 to an organization

Microsoft 365 is added directly at the organization level.

  1. From the side navigation menu in Kaseya MDR, click Organizations.

  2. Click the Edit Organization (pencil) icon of the organization you want to configure.

  3. Go to the Applications tab and click + New Application.

  4. Select the Microsoft Manage tile.

  5. Enable Auto-Upgrade (Recommended): Select the option to allow Kaseya MDR to automatically manage and upgrade required API permissions in the future.

  6. Click Connect to start the Microsoft sign‑in/consent flow.

  7. When prompted, sign in using a Global Administrator account from the customer’s Microsoft tenant.

  8. Review the requested permissions and select Accept to complete the connection.

Connection permissions auto‑upgrade

During the Microsoft 365 connection flow, you are prompted to choose whether to enable connection permissions auto upgrade.

  • Enable connection permissions auto‑upgrade (recommended): Allows the integration to automatically update required permissions in the future without requiring separate manual approval.

  • Disable connection permissions auto‑upgrade: Requires manual approval if additional permissions are needed in the future.

This setting can be changed later after the connection is created.

Important: This setting controls permission management only. It does not determine which alerts are generated, which activity is collected, or which response actions are available.

Verifying the connection

After the connection is established, use the following checks to confirm it is working as expected:

  • Application status: The Microsoft Manage application should show a green Active status in the organization’s application list.

  • Event synchronization: Initial connectivity is typically established within 30–60 seconds. User and activity data may take up to 30 minutes to fully populate.

  • Activity validation: Open the Analysis area and confirm that Microsoft‑sourced events, such as sign‑in and file activity, are appearing for the intended organization.

Synchronization timing can vary by tenant and environment.

Troubleshooting

  • No sign‑in window appears: Check whether the browser blocked the Microsoft consent pop‑up. Allow pop‑ups for the MDR site and retry the connection.

  • Connection shows as broken or needs attention: This often occurs if the account used during the initial setup had its password changed or was deleted. Use the Repair option to re‑authenticate the Microsoft connection.

  • Expected data is missing: Confirm the correct organization was selected and verify that permissions were successfully accepted in the customer tenant. If specific reports are empty, verify the appropriate Entra ID licenses are assigned.

Respond (MDR context)

Kaseya MDR includes Respond capabilities that can be configured to support automated actions after investigation patterns are understood. Availability of actions and workflows depends on MDR configuration and enabled capabilities.

Once Microsoft 365 is connected, Microsoft‑sourced telemetry can be used as part of these investigations, subject to configuration.