Enable Cloud Malware Protection for Microsoft 365 Tenants
Secure Access supports Cloud Malware protection for OneDrive and SharePoint sites within your Microsoft 365 deployment.
Secure Access also supports Cloud Access Security Broker (CASB) detection of third-party cloud applications that have been granted OAuth-based permission to access a user's protected resources on Microsoft 365.
Note on running both MS365 and Cloud Malware: MS365 and Cloud Malware both protect users against malware. However, their functionalities are not redundant. MS365 might discover malware that Cloud Malware does not find. Cloud Malware also finds malware that MS365 overlooks. There is value to running MS365 and Cloud Malware simultaneously.
Table of Contents
Prerequisites
- Full Admin user role. For more information, see Manage Accounts.
- Chrome or Firefox (recommended) with pop-up blockers and ad blockers disabled (only for the duration of authorization)
- The user performing the installation must use a service account with a Microsoft 365 Global Admin and active license
- Audit log must be enabled for Microsoft 365. For more information, refer to Microsoft Technical documentation and search for Turn auditing on or off.
- SharePoint Online and OneDrive must be enabled
- The following IP addresses must be allowed if there are Firewall rules that prevent third-party applications:
52.73.52.135, 52.71.142.118, 52.40.204.69, 52.35.119.173, 52.27.150.153 - Users must have the following API permissions for Microsoft:
| API/ Permissions Name | Type | Description | Admin Consent Required |
|---|---|---|---|
| Microsoft Graph | |||
| 1. Directory.AccessAsUser.All | Delegated | Access directory as the signed-in user | Yes |
| 2. Directory.Read.All | Application | Read directory data | Yes |
| 3. Files.Read.All | Delegated | Read all files that user can access | No |
| 4. Files.Read.All | Application | Read files in all site collections | Yes |
| 5. Sites.Read.All | Delegated | Read items in all site collections | No |
| 6. User.Read | Delegated | Sign in and read user profile | No |
| 7. User.Read.All | Application | Read all users' full profiles | Yes |
| Microsoft 365 Management APIs | |||
| 1. AcitivityFeed.Read | Application | Read activity data for the Organization | Yes |
| SharePoint | |||
| 1. Site.FullControl.All | Application | Full control of all site collections | Yes |
| 2. User.Read.All | Application | Read user profiles | Yes |
Authorize a Tenant
- Navigate to Admin > Authentication.
- Click to expand Microsoft 365 in the list of Platforms.
- Click Authorize New Tenant in the Cloud Access Security Broker subsection to add a Microsoft 365 tenant to your Secure Access environment.
- Check the boxes to confirm that you meet all three Authentication Requirements in the Microsoft 365 Authorization Prerequisites dialog, then click Next.
- Create a name for your tenant, then click Next.
- Select one or both Cloud Access Security Broker (CASB) features to authenticate: Cloud Malware and Third-Party Apps. Select the Monitor or Quarantine response action for Cloud Malware only. Click Next.
For more information on Cloud Malware monitoring and quarantine features, see Manage Cloud Malware Protection. For more information on Third-Party Apps detection features, see Third-Party Apps Report.
- Click Next and log into Microsoft 365 with admin credentials to authorize your Microsoft 365 account as a Secure Access CASB.
Secure Access displays a message when the authorization is complete. It can take up to 24 hours for the CASB integration status in Secure Access to show that authorization is complete.
- Click Done to complete.
Revoke Authorization
- Under Action, click Revoke. You can revoke any authorized tenant.
- Confirm to proceed. The selected account is not authorized.
Enable Cloud Malware Protection for Box Tenants < Enable Cloud DLP Protection for Microsoft 365 Tenants > Enable Cloud Malware Protection for Webex Teams Tenants
Updated 1 day ago