> ## Documentation Index > Fetch the complete documentation index at: https://docs.rallied.ai/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft 365 agent tools > See what the agent can do in each customer's Microsoft 365 tenant, from users and mailboxes to inbox rules, SharePoint, message trace, and Conditional Access. Start with Exchange access, which decides whether the Exchange tools on this page work in a tenant. You need the [Microsoft 365 integration](/integrations/microsoft-365.md) connected and the tenant reading **Ready**. > [!NOTE] > > Every tool follows its setting in the **Permission** column of the integration's **Policies** tab. Write operations (password reset, user creation, group changes) default to **Approval needed**. See [Approval settings](/dashboard/policies.md). ## Exchange access The table below shows which Exchange tools run through CIPP when it's connected. Every other Exchange tool needs consent for `Exchange.ManageAsApp` and the Exchange Administrator role on the Rallied app in that tenant. Rallied assigns the role itself with the two setup permissions from [Phase 3, Step 2](/integrations/microsoft-365.md#step-2-choose-how-rallied-gets-access), or you can [assign it manually](/integrations/microsoft-365.md#alternative-assign-the-directory-roles-manually). | Tool | Runs through CIPP when connected | | - | - | | Distribution groups, shared mailboxes | Yes | | Message trace | Yes | | Forwarding and inbox rules | No | | Licensed shared mailbox check | No | ## Users, groups, and mailboxes The agent can: * Create, disable, and enable users, assign and remove licenses, and reset passwords. * Add and remove members of security groups and mail-enabled distribution lists. * Grant shared mailbox access, convert a mailbox to a shared mailbox, and forward email. * Revoke a user's active sign-in sessions, look up sign-in failures, and check risky-user status. * Send email from a mailbox in the customer's tenant, for example to tell a manager during an incident that a compromised account has been contained. For the roles user changes need, see [Which roles count](/integrations/microsoft-365.md#which-roles-count). ## Email forwarding and inbox rules A compromised account exfiltrates mail through two mechanisms that Exchange tracks separately. The agent can act on both. | Mechanism | What it is | What the agent can do | | - | - | - | | Mailbox-level forwarding | The forwarding setting on the mailbox itself, what admins usually mean by "a forwarding rule" | Set forwarding to an SMTP address (optionally keeping a copy in the mailbox), or stop it. Stopping clears both the modern and legacy Exchange forwarding fields, so a rule set through the older field stops too | | Outlook inbox rules | Client-side rules created in Outlook that forward, redirect, delete, or move mail. They don't appear in mailbox-level forwarding settings, which makes them the more common account-takeover vector | List a mailbox's rules, including what each one does, and remove a specific rule | For a security alert about suspicious auto-forwarding, the agent checks mailbox-level forwarding, lists the inbox rules, and removes whatever is exfiltrating mail. Setting or removing forwarding and removing an inbox rule default to **Approval needed**, and end users can never run them. Listing inbox rules is read-only, so end users can ask why their own mail is going somewhere else. > [!NOTE] > > These tools aren't yet available through CIPP. In a tenant whose Exchange access goes through CIPP, assign the Exchange Administrator role to the Rallied app directly. See [Exchange access](#exchange-access). ## SharePoint and OneDrive The agent handles tickets like "where is this file", "I deleted a folder", and "give Sam access to the Finance folder". These tools work on every connection path and need only `Sites.FullControl.All` from the [required set](/integrations/microsoft-365.md#permissions-rallied-requires). | Task | What the agent does | Default policy | | - | - | - | | Find a site and its libraries | Searches sites by name and lists a site's document libraries | Auto | | Browse and search files | Lists a folder's contents, searches a library by name, and reads a file or folder's details | Auto | | Check who has access | Lists a site's permissions, or the people, groups, and sharing links on one folder or file | Auto | | List deleted items | Lists a site's recycle bin, with who deleted each item and when | Auto | | Restore deleted items | Restores up to 20 files or folders from a site's recycle bin to their original location | Approval needed | | Grant access to a folder or file | Gives a person or group read or write access, with no email and no sharing link | Approval needed | | Remove access to a folder or file | Removes one person's, group's, or sharing link's access | Approval needed | | Grant access to a site or library | Gives a person Read, Contribute, or Edit on a whole site or one library | Approval needed | A typical request from a technician: ```text theme={"system"} Restore the "Q3 Invoices" folder that was deleted from the Finance site yesterday. ``` The agent lists the site's recycle bin, finds the folder, and proposes the restore. The approval plan names each item and the folder it returns to. Keep these limits in mind: * **Restore and site-level grants need CIPP.** Microsoft Graph can't do either, so Rallied runs them through [CIPP](/integrations/cipp.md). Restore needs CIPP 10.6.0 or later, and site or library grants need 10.9.0 or later. Without CIPP, the agent explains why it can't make the change. * **For a Team or Microsoft 365 group site, add the person to the group.** That's the usual way to grant site access, and it doesn't need CIPP. * **The person must already exist in the tenant.** The agent can grant access to members and to existing guests. Microsoft doesn't let an app invite a new guest. * **Inherited access is removed where it's set.** The agent can only remove a permission set directly on that folder or file. It never removes the site's Owners permission, and it can't remove site-level access. A technician does that in SharePoint or CIPP. * **No file content.** The agent reads names, paths, sizes, dates, and who has access. It never reads file content, download links, or sharing link URLs. End users can ask which document libraries their company's site has. Browsing files, reading permissions, and every write are technician-only. ## Licensed shared mailboxes A converted shared mailbox keeps its user's license until someone removes it, but a shared mailbox under 50 GB doesn't need one. The agent can find these across every customer on your CSP contract in one request. Ask it from [Chat](/dashboard/chat.md): ```text theme={"system"} Find any shared mailboxes across our customers that still have a license assigned. ``` The agent reports the customer, account name, and licenses for each one. You can also ask for counts, like "how many per customer" or "how many of each license". When you read the results: * **A result is a candidate, not a verdict.** A shared mailbox does need a license when it has an online archive, is on litigation hold, or is over 50 GB. The agent reports archive and litigation hold status, but not mailbox size, so check size before you remove a license. * **The agent translates Microsoft's license part numbers.** For example, Business Premium is `SPB` and Exchange Online Plan 2 is `EXCHANGEENTERPRISE`. * **No costs are included.** To see what the licenses cost, ask the agent to check your [Pax8](/integrations/pax8.md) subscriptions. * **Large contracts take several passes.** The agent reads Exchange and Microsoft Graph for every customer, so it continues in batches until it has checked every customer. * **Some customers may not be checked.** The agent says how many and why. Not checked isn't the same as no licensed shared mailboxes. > [!NOTE] > > This check reads Exchange directly and doesn't go through CIPP. The agent lists tenants without [Exchange access](#exchange-access) as not checked. This check is read-only and runs on **Auto** by default. ## Message trace The agent traces email through Exchange Online to answer "did my email arrive?" and "is this email safe?". For each message, it reports when it was received, sender, recipient, subject, delivery status, and the sending server's IP address, which shows a suspicious email's real origin. A typical request from a technician: ```text theme={"system"} Did the invoice from billing@vendor.com reach sam@acme.com yesterday? If not, what happened to it? ``` The agent filters by sender, recipient, delivery status (for example `Delivered`, `Failed`, `FilteredAsSpam`, or `Quarantined`), subject, or Message-ID. Keep these limits in mind: * **Last 90 days, 10 days at a time.** Microsoft keeps trace data for 90 days and returns at most 10 days per query. Without dates, the agent searches the last 48 hours. * **Same access as other Exchange tools.** No extra permission. Tenants whose Exchange access goes through CIPP are traced through CIPP. * **Technicians only.** A trace shows other people's mail metadata, so end users can't run it. Message trace is read-only and runs on **Auto** by default. ## Conditional Access policies The agent reads a tenant's Conditional Access policies and named locations to answer "why is this user asked for MFA?" or "why is this sign-in blocked?", or to audit which policies exclude a user or group. For each policy, the agent reports its state (enabled, disabled, or report-only), who and which apps it applies to, its conditions, and its grant and session controls. Users, groups, roles, and locations show by name where Rallied can resolve them. Named locations show their IP ranges or countries and whether they're marked trusted. > [!NOTE] > > Reading Conditional Access needs `Policy.Read.All`, which Rallied's app doesn't request. Without it, Rallied answers through [CIPP](/integrations/cipp.md) if it's connected. Otherwise, the agent tells you it can't read the policies. These tools are read-only, run on **Auto** by default, and are technician-only. ## Related * [Microsoft 365 setup](/integrations/microsoft-365.md) * [CIPP](/integrations/cipp.md) * [Approval settings](/dashboard/policies.md) * [Chat with your agent](/dashboard/chat.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.