---
title: 'Getting Started With Microsoft 365 on Prowler'
---

<Note>
**Government Cloud Support**

Government cloud accounts or tenants (Microsoft 365 Government) are currently unsupported, but we expect to add support for them in the near future.

</Note>
## Prerequisites

Configure authentication for Microsoft 365 by following the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide. This includes:

- Registering an application in Microsoft Entra ID
- Granting all required Microsoft Graph and external API permissions
- Generating the application certificate (recommended) or client secret
- Setting up PowerShell module permissions (for full security coverage)

## Prowler App

### Step 1: Obtain Domain ID

1. Go to the Entra ID portal, then search for "Domain" or go to Identity > Settings > Domain Names

    ![Search Domain Names](/images/providers/search-domain-names.png)

    ![Custom Domain Names](/images/providers/custom-domain-names.png)

2. Select the domain to use as unique identifier for the Microsoft 365 account in Prowler App

### Step 2: Access Prowler App

1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
2. Navigate to "Configuration" > "Cloud Providers"

    ![Cloud Providers Page](/images/prowler-app/cloud-providers-page.png)

3. Click on "Add Cloud Provider"

    ![Add a Cloud Provider](/images/prowler-app/add-cloud-provider.png)

4. Select "Microsoft 365"

    ![Select Microsoft 365](/images/providers/select-m365-prowler-cloud.png)

5. Add the Domain ID and an optional alias, then click "Next"

    ![Add Domain ID](/images/providers/add-domain-id.png)

### Step 3: Select Authentication Method and Provide Credentials

Prowler App now separates Microsoft 365 authentication into two app-only options. After adding the Domain ID, choose the method that matches your setup:

<img src="/images/providers/m365-auth-selection-form.png" alt="M365 authentication method selection" width="700" />

#### Application Certificate Authentication (Recommended)

1. Copy the Application (client) ID and Tenant ID from the app registration overview page.
2. Paste both values into the Prowler App form.
3. Upload the PFX bundle or paste the Base64-encoded certificate (`M365_CERTIFICATE_CONTENT`), then click **Test Connection**.

<img src="/images/providers/certificate-form.png" alt="M365 certificate authentication form" width="700" />

Use this method whenever possible to avoid managing client secrets and to unlock every Microsoft 365 check, including those that require PowerShell modules.

#### Application Client Secret Authentication

1. From the app registration, copy the Application (client) ID and Tenant ID.
2. Paste both values plus the client secret into the Prowler App form.
3. Click **Test Connection** to validate the credentials.

<img src="/images/providers/secret-form.png" alt="M365 client secret authentication form" width="700" />


### Step 4: Launch the Scan

1. Review the summary, then click **Next**.

    ![Next Detail](/images/providers/click-next-m365.png)

2. Click **Launch Scan** to start auditing Microsoft 365.

    ![Launch Scan M365](/images/providers/launch-scan.png)

---

## Prowler CLI

Use Prowler CLI to scan Microsoft 365 environments.

### PowerShell Requirements

PowerShell 7.4+ is required for comprehensive Microsoft 365 security coverage. Installation instructions are available in the [Authentication guide](/user-guide/providers/microsoft365/authentication#supported-powershell-versions).

### Authentication Options

Select an authentication method from the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide:

- **Application Certificate Authentication** (recommended): `--certificate-auth`
- **Application Client Secret Authentication**: `--sp-env-auth`
- **Azure CLI Authentication**: `--az-cli-auth`
- **Interactive Browser Authentication**: `--browser-auth`

### Basic Usage

After configuring authentication, run a basic scan:

```console
prowler m365 --sp-env-auth
```

For comprehensive scans including PowerShell checks:

```console
prowler m365 --sp-env-auth --init-modules
```

---