Skip to main content
Start with Exchange access, which decides whether the Exchange tools on this page work in a tenant. You need the Microsoft 365 integration connected and the tenant reading Ready.
Every tool follows its setting in the Permission column of the integration’s Policies tab. Write operations (password reset, user creation, group changes) default to Approval needed. See Approval settings.

​
Exchange access

The table below shows which Exchange tools run through CIPP when it’s connected. Every other Exchange tool needs consent for Exchange.ManageAsApp and the Exchange Administrator role on the Rallied app in that tenant. Rallied assigns the role itself with the two setup permissions from Phase 3, Step 2, or you can assign it manually.

​
Users, groups, and mailboxes

The agent can:
  • Create, disable, and enable users, assign and remove licenses, and reset passwords.
  • Add and remove members of security groups and mail-enabled distribution lists.
  • Grant shared mailbox access, convert a mailbox to a shared mailbox, and forward email.
  • Revoke a user’s active sign-in sessions, look up sign-in failures, and check risky-user status.
  • Send email from a mailbox in the customer’s tenant, for example to tell a manager during an incident that a compromised account has been contained.
For the roles user changes need, see Which roles count.

​
Email forwarding and inbox rules

A compromised account exfiltrates mail through two mechanisms that Exchange tracks separately. The agent can act on both. For a security alert about suspicious auto-forwarding, the agent checks mailbox-level forwarding, lists the inbox rules, and removes whatever is exfiltrating mail. Setting or removing forwarding and removing an inbox rule default to Approval needed, and end users can never run them. Listing inbox rules is read-only, so end users can ask why their own mail is going somewhere else.
These tools aren’t yet available through CIPP. In a tenant whose Exchange access goes through CIPP, assign the Exchange Administrator role to the Rallied app directly. See Exchange access.

​
SharePoint and OneDrive

The agent handles tickets like “where is this file”, “I deleted a folder”, and “give Sam access to the Finance folder”. These tools work on every connection path and need only Sites.FullControl.All from the required set. A typical request from a technician:
The agent lists the site’s recycle bin, finds the folder, and proposes the restore. The approval plan names each item and the folder it returns to. Keep these limits in mind:
  • Restore and site-level grants need CIPP. Microsoft Graph can’t do either, so Rallied runs them through CIPP. Restore needs CIPP 10.6.0 or later, and site or library grants need 10.9.0 or later. Without CIPP, the agent explains why it can’t make the change.
  • For a Team or Microsoft 365 group site, add the person to the group. That’s the usual way to grant site access, and it doesn’t need CIPP.
  • The person must already exist in the tenant. The agent can grant access to members and to existing guests. Microsoft doesn’t let an app invite a new guest.
  • Inherited access is removed where it’s set. The agent can only remove a permission set directly on that folder or file. It never removes the site’s Owners permission, and it can’t remove site-level access. A technician does that in SharePoint or CIPP.
  • No file content. The agent reads names, paths, sizes, dates, and who has access. It never reads file content, download links, or sharing link URLs.
End users can ask which document libraries their company’s site has. Browsing files, reading permissions, and every write are technician-only.

​
Licensed shared mailboxes

A converted shared mailbox keeps its user’s license until someone removes it, but a shared mailbox under 50 GB doesn’t need one. The agent can find these across every customer on your CSP contract in one request. Ask it from Chat:
The agent reports the customer, account name, and licenses for each one. You can also ask for counts, like “how many per customer” or “how many of each license”. When you read the results:
  • A result is a candidate, not a verdict. A shared mailbox does need a license when it has an online archive, is on litigation hold, or is over 50 GB. The agent reports archive and litigation hold status, but not mailbox size, so check size before you remove a license.
  • The agent translates Microsoft’s license part numbers. For example, Business Premium is SPB and Exchange Online Plan 2 is EXCHANGEENTERPRISE.
  • No costs are included. To see what the licenses cost, ask the agent to check your Pax8 subscriptions.
  • Large contracts take several passes. The agent reads Exchange and Microsoft Graph for every customer, so it continues in batches until it has checked every customer.
  • Some customers may not be checked. The agent says how many and why. Not checked isn’t the same as no licensed shared mailboxes.
This check reads Exchange directly and doesn’t go through CIPP. The agent lists tenants without Exchange access as not checked.
This check is read-only and runs on Auto by default.

​
Message trace

The agent traces email through Exchange Online to answer “did my email arrive?” and “is this email safe?”. For each message, it reports when it was received, sender, recipient, subject, delivery status, and the sending server’s IP address, which shows a suspicious email’s real origin. A typical request from a technician:
The agent filters by sender, recipient, delivery status (for example Delivered, Failed, FilteredAsSpam, or Quarantined), subject, or Message-ID. Keep these limits in mind:
  • Last 90 days, 10 days at a time. Microsoft keeps trace data for 90 days and returns at most 10 days per query. Without dates, the agent searches the last 48 hours.
  • Same access as other Exchange tools. No extra permission. Tenants whose Exchange access goes through CIPP are traced through CIPP.
  • Technicians only. A trace shows other people’s mail metadata, so end users can’t run it.
Message trace is read-only and runs on Auto by default.

​
Conditional Access policies

The agent reads a tenant’s Conditional Access policies and named locations to answer “why is this user asked for MFA?” or “why is this sign-in blocked?”, or to audit which policies exclude a user or group. For each policy, the agent reports its state (enabled, disabled, or report-only), who and which apps it applies to, its conditions, and its grant and session controls. Users, groups, roles, and locations show by name where Rallied can resolve them. Named locations show their IP ranges or countries and whether they’re marked trusted.
Reading Conditional Access needs Policy.Read.All, which Rallied’s app doesn’t request. Without it, Rallied answers through CIPP if it’s connected. Otherwise, the agent tells you it can’t read the policies.
These tools are read-only, run on Auto by default, and are technician-only.