Microsoft 365

​

Overview

The Microsoft 365 integration uses a multi-tenant app registration in your MSP’s partner tenant to manage customer tenants via GDAP. Once connected, the agent can:

• Manage user lifecycle — create, disable, and enable users; assign and remove licenses; reset passwords.
• Manage groups and distribution lists — add and remove members from both security groups and mail-enabled distribution lists.
• Manage Exchange mailboxes — grant shared mailbox access, convert to shared mailbox, forward email.
• Respond to security incidents — revoke active sign-in sessions for a user, look up sign-in failures, and check risky-user status.
• Send email on behalf of a mailbox — for out-of-band notifications during an incident (e.g. notifying a manager that a compromised account has been contained).

---

​

Phase 1: Configure the MSP’s partner tenant

These steps are performed once in the MSP’s own Entra tenant.

​

1. Create an app registration

1. Sign in to entra.microsoft.com with your partner tenant admin account
2. Navigate to Applications → App registrations → + New registration
3. Fill in:
   • Name — e.g. Rallied Integration (this display name appears in role pickers across all customer tenants — make it recognizable)
   • Supported account types — select “Accounts in any organizational directory (Multitenant)”
   • Redirect URI — add one: type Web, any URL you control (e.g. your Rallied dashboard URL). It isn’t used at runtime, but Phase 3’s admin-consent step needs one registered.
4. Click Register

​

2. Generate a client secret

1. In the app registration, go to Certificates & secrets → + New client secret
2. Set a description (e.g. Rallied production) and expiration (24 months recommended)
3. Click Add

​

3. Add API permissions

Navigate to API permissions → + Add a permission and add all of the following as Application permissions. Microsoft Graph (under Microsoft APIs → Microsoft Graph): Exchange Online (under APIs my organization uses → Office 365 Exchange Online):

​

4. Grant admin consent

Still on the API permissions page:

1. Click Grant admin consent for [your organization] at the top
2. Confirm in the dialog
3. Verify the Status column shows a green checkmark (“Granted”) for every permission

---

​

Phase 2: Connect in Rallied

1. In Rallied, go to the MSP’s page → Integrations → Microsoft 365
2. Click Connect
3. Enter:
   • Application (Client) ID — from Phase 1, Step 1
   • Client Secret — from Phase 1, Step 2
   • Partner Tenant ID — from Phase 1, Step 1
4. Click Submit

Rallied validates credentials by acquiring an app-only token from Microsoft Entra ID. If successful, the integration appears as connected.

---

​

Phase 3: Onboard customer tenants

​

Who can perform these steps

• A Global Administrator (or Privileged Role Administrator) of the customer tenant, OR
• The MSP acting via GDAP, if the relationship includes Global Administrator or Privileged Role Administrator

​

Step 1: Sync from Microsoft

Click Sync in the Companies tab to discover all customer tenants in your GDAP relationships. New tenants appear in the table with status Pending.

​

Step 2: Grant admin consent

For each tenant where Consent shows Pending:

1. Click Grant admin consent on that row
2. Sign in as a Global Administrator (or PRA) of the customer tenant — or use GDAP if your relationship includes those roles
3. Approve the permissions in the Microsoft consent dialog

​

Step 3: Assign the Exchange Administrator role

For each tenant where Exchange shows Pending:

1. Click Assign Exchange Admin role on that row (opens Entra for that tenant)
2. In Entra, go to Identity → Roles & admins
3. Click the Exchange Administrator role
4. Click Add assignment and add the Rallied app’s service principal

​

Step 3b: Assign the User Administrator role

For each tenant where User Admin role shows Pending:

1. Click Assign role on that row (opens Entra for that tenant)
2. In Entra, go to Identity → Roles & admins
3. Click the User Administrator role
4. Click Add assignment and add the Rallied app’s service principal

​

Step 4: Wait for propagation

Microsoft caches role permissions for 30 minutes to 2 hours. Tools may return 403 during this window even when the setup is correct.

​

Step 5: Re-verify

Click Re-verify on the row to refresh status. When both badges turn green, the tenant is ready. Confirm by asking the agent to list users or distribution groups for that company.

---

​

Optional: Connect CIPP

If your MSP already runs CIPP, connecting the CIPP integration is the fastest way to get every customer tenant ready. It saves two big chunks of work:

• Grant admin consent across all your tenants at once. No more clicking Grant admin consent on each row in Phase 3. Per-row consent still works for any tenant CIPP can’t reach.
• Use Exchange tools without assigning the Exchange Administrator role per tenant. The agent picks up distribution groups and shared mailboxes through CIPP automatically, so you can skip Phase 3, Step 3 for those tenants. They show Exchange: working (cipp) on the Companies tab.

CIPP is optional. Without it, the integration still works exactly as described in Phases 1–3. You’ll just do the consent and Exchange role assignment manually, one tenant at a time. Setup, credential rotation, and troubleshooting live on the CIPP integration page.

---

​

Required permissions summary

---

​

Troubleshooting

CIPP-specific issues (invalid client secret, missing bulk-grant button, Exchange still pending) are covered in the CIPP troubleshooting section.

---

​

Reference links