mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 12:31:54 +00:00
Hugo Pereira Brito
120 lines
4.1 KiB
Plaintext
120 lines
4.1 KiB
Plaintext
---
|
|
title: 'Getting Started With Microsoft 365 on Prowler'
|
|
---
|
|
|
|
<Note>
|
|
**Government Cloud Support**
|
|
|
|
Government cloud accounts or tenants (Microsoft 365 Government) are currently unsupported, but we expect to add support for them in the near future.
|
|
|
|
</Note>
|
|
## Prerequisites
|
|
|
|
Configure authentication for Microsoft 365 by following the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide. This includes:
|
|
|
|
- Registering an application in Microsoft Entra ID
|
|
- Granting all required Microsoft Graph and external API permissions
|
|
- Generating the application certificate (recommended) or client secret
|
|
- Setting up PowerShell module permissions (for full security coverage)
|
|
|
|
## Prowler App
|
|
|
|
### Step 1: Obtain Domain ID
|
|
|
|
1. Go to the Entra ID portal, then search for "Domain" or go to Identity > Settings > Domain Names
|
|
|
|
|
|
|
|
|
|
|
|
2. Select the domain to use as unique identifier for the Microsoft 365 account in Prowler App
|
|
|
|
### Step 2: Access Prowler App
|
|
|
|
1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler App](/user-guide/tutorials/prowler-app)
|
|
2. Navigate to "Configuration" > "Cloud Providers"
|
|
|
|
|
|
|
|
3. Click on "Add Cloud Provider"
|
|
|
|
|
|
|
|
4. Select "Microsoft 365"
|
|
|
|
|
|
|
|
5. Add the Domain ID and an optional alias, then click "Next"
|
|
|
|
|
|
|
|
### Step 3: Select Authentication Method and Provide Credentials
|
|
|
|
Prowler App now separates Microsoft 365 authentication into two app-only options. After adding the Domain ID, choose the method that matches your setup:
|
|
|
|
<img src="/images/providers/m365-auth-selection-form.png" alt="M365 authentication method selection" width="700" />
|
|
|
|
#### Application Certificate Authentication (Recommended)
|
|
|
|
1. Copy the Application (client) ID and Tenant ID from the app registration overview page.
|
|
2. Paste both values into the Prowler App form.
|
|
3. Upload the PFX bundle or paste the Base64-encoded certificate (`M365_CERTIFICATE_CONTENT`), then click **Test Connection**.
|
|
|
|
<img src="/images/providers/certificate-form.png" alt="M365 certificate authentication form" width="700" />
|
|
|
|
Use this method whenever possible to avoid managing client secrets and to unlock every Microsoft 365 check, including those that require PowerShell modules.
|
|
|
|
#### Application Client Secret Authentication
|
|
|
|
1. From the app registration, copy the Application (client) ID and Tenant ID.
|
|
2. Paste both values plus the client secret into the Prowler App form.
|
|
3. Click **Test Connection** to validate the credentials.
|
|
|
|
<img src="/images/providers/secret-form.png" alt="M365 client secret authentication form" width="700" />
|
|
|
|
|
|
### Step 4: Launch the Scan
|
|
|
|
1. Review the summary, then click **Next**.
|
|
|
|
|
|
|
|
2. Click **Launch Scan** to start auditing Microsoft 365.
|
|
|
|
|
|
|
|
---
|
|
|
|
## Prowler CLI
|
|
|
|
Use Prowler CLI to scan Microsoft 365 environments.
|
|
|
|
### PowerShell Requirements
|
|
|
|
PowerShell 7.4+ is required for comprehensive Microsoft 365 security coverage. Installation instructions are available in the [Authentication guide](/user-guide/providers/microsoft365/authentication#supported-powershell-versions).
|
|
|
|
### Authentication Options
|
|
|
|
Select an authentication method from the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide:
|
|
|
|
- **Application Certificate Authentication** (recommended): `--certificate-auth`
|
|
- **Application Client Secret Authentication**: `--sp-env-auth`
|
|
- **Azure CLI Authentication**: `--az-cli-auth`
|
|
- **Interactive Browser Authentication**: `--browser-auth`
|
|
|
|
### Basic Usage
|
|
|
|
After configuring authentication, run a basic scan:
|
|
|
|
```console
|
|
prowler m365 --sp-env-auth
|
|
```
|
|
|
|
For comprehensive scans including PowerShell checks:
|
|
|
|
```console
|
|
prowler m365 --sp-env-auth --init-modules
|
|
```
|
|
|
|
---
|