mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-24 21:11:53 +00:00
Andoni Alonso
120 lines
4.3 KiB
Plaintext
120 lines
4.3 KiB
Plaintext
---
|
|
title: 'Getting Started With Microsoft 365 on Prowler'
|
|
---
|
|
|
|
<Note>
|
|
**Government Cloud Support**
|
|
|
|
Government cloud accounts or tenants (Microsoft 365 Government) are currently unsupported, but we expect to add support for them in the near future.
|
|
|
|
</Note>
|
|
## Prerequisites
|
|
|
|
Configure authentication for Microsoft 365 by following the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide. This includes:
|
|
|
|
- Registering an application in Microsoft Entra ID
|
|
- Granting all required Microsoft Graph and external API permissions
|
|
- Generating the application certificate (recommended) or client secret
|
|
- Setting up PowerShell module permissions (for full security coverage)
|
|
|
|
## Prowler App
|
|
|
|
### Step 1: Obtain Domain ID
|
|
|
|
1. Go to the Entra ID portal, then search for "Domain" or go to Identity > Settings > Domain Names
|
|
|
|
|
|
|
|
|
|
|
|
2. Select the domain to use as unique identifier for the Microsoft 365 account in Prowler App
|
|
|
|
### Step 2: Access Prowler App
|
|
|
|
1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
|
|
2. Navigate to "Configuration" > "Cloud Providers"
|
|
|
|
|
|
|
|
3. Click on "Add Cloud Provider"
|
|
|
|
|
|
|
|
4. Select "Microsoft 365"
|
|
|
|
|
|
|
|
5. Add the Domain ID and an optional alias, then click "Next"
|
|
|
|
|
|
|
|
### Step 3: Select Authentication Method and Provide Credentials
|
|
|
|
Prowler App now separates Microsoft 365 authentication into two app-only options. After adding the Domain ID (primary tenant domain), choose the method that matches your setup:
|
|
|
|
<img src="/images/providers/m365-auth-selection-form.png" alt="M365 authentication method selection" width="700" />
|
|
|
|
#### Application Certificate Authentication (Recommended)
|
|
|
|
1. Enter your **tenant ID**: This is the unique identifier for your Microsoft Entra ID directory.
|
|
2. Enter your **application (client) ID**: This is the unique identifier assigned to your app registration in Microsoft Entra ID.
|
|
3. Upload your **certificate file content**: This is the Base64 encoded certificate content used to authenticate your application.
|
|
|
|
<img src="/images/providers/certificate-form.png" alt="M365 certificate authentication form" width="700" />
|
|
|
|
Use this method whenever possible to avoid managing client secrets and to unlock every Microsoft 365 check, including those that require PowerShell modules.
|
|
|
|
#### Application Client Secret Authentication
|
|
|
|
1. Enter your **tenant ID**: This is the unique identifier for your Microsoft Entra ID directory.
|
|
2. Enter your **application (client) ID**: This is the unique identifier assigned to your app registration in Microsoft Entra ID.
|
|
3. Enter your **client secret**: This is the secret key used to authenticate your application.
|
|
|
|
<img src="/images/providers/secret-form.png" alt="M365 client secret authentication form" width="700" />
|
|
|
|
|
|
### Step 4: Launch the Scan
|
|
|
|
1. Review the summary, then click **Next**.
|
|
|
|
|
|
|
|
2. Click **Launch Scan** to start auditing Microsoft 365.
|
|
|
|
|
|
|
|
---
|
|
|
|
## Prowler CLI
|
|
|
|
Use Prowler CLI to scan Microsoft 365 environments.
|
|
|
|
### PowerShell Requirements
|
|
|
|
PowerShell 7.4+ is required for comprehensive Microsoft 365 security coverage. Installation instructions are available in the [Authentication guide](/user-guide/providers/microsoft365/authentication#supported-powershell-versions).
|
|
|
|
### Authentication Options
|
|
|
|
Select an authentication method from the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide:
|
|
|
|
- **Application Certificate Authentication** (recommended): `--certificate-auth`
|
|
- **Application Client Secret Authentication**: `--sp-env-auth`
|
|
- **Azure CLI Authentication**: `--az-cli-auth`
|
|
- **Interactive Browser Authentication**: `--browser-auth`
|
|
|
|
### Basic Usage
|
|
|
|
After configuring authentication, run a basic scan:
|
|
|
|
```console
|
|
prowler m365 --sp-env-auth
|
|
```
|
|
|
|
For comprehensive scans including PowerShell checks:
|
|
|
|
```console
|
|
prowler m365 --sp-env-auth --init-modules
|
|
```
|
|
|
|
---
|