TigerGate scans your Microsoft 365 tenant’s security posture (conditional access, mailbox settings, Defender/Purview configuration, sharing policies, and more) via an Azure AD app registration using client-credential auth.
The app registration only needs read-only Graph API permissions. TigerGate can never change tenant settings, mailboxes, or policies.

​
Before you start

In TigerGate, go to Integrations → Cloud Providers and choose Microsoft 365. You’ll fill in three values once the app registration exists:
ValueWhat it is
Tenant IDYour Microsoft 365 / Azure AD tenant ID.
Client IDThe app registration’s application (client) ID.
Client SecretA secret generated for the app registration.

​
1. Create the app registration

1

Register the app

In the Azure Portal → Azure AD → App registrations → New registration, name it TigerGate CSPM Scan and register it in this tenant only.
2

Add read-only Graph API permissions

Under API permissions → Add a permission → Microsoft Graph → Application permissions, add:
  • Organization.Read.All
  • Policy.Read.All
  • SecurityEvents.Read.All
  • Directory.Read.All
  • Reports.Read.All
Click Grant admin consent — application permissions don’t take effect until an admin consents.
3

Create a client secret

Under Certificates & secrets → New client secret, create one and copy the Value immediately — it’s shown once.

​
2. Connect it in TigerGate

1

Fill in the three values

In Integrations → Cloud Providers, choose Microsoft 365 and enter the Tenant ID, Client ID (both from the app registration’s Overview page), and the Client Secret value you copied.
2

Test

Click Test. For Microsoft 365 this confirms all three fields are filled in — TigerGate does not yet perform a live Graph API sign-in from the Test button. Credential problems (bad secret, missing admin consent, wrong tenant) therefore surface on the first scan rather than here.
3

Scan or schedule

Run an on-demand scan, or add a Schedule for recurring scans.

​
Troubleshooting

Because the Test button only checks that the three fields are filled in, these errors surface when a scan actually authenticates to Microsoft Graph.
Scan errorCauseFix
AADSTS7000215 invalid client secretThe Secret ID (a GUID) was pasted instead of the Value column — the actual secret string, only shown once right after creationGo to Certificates & secrets, generate a new secret, and copy the Value column this time (not Secret ID) — update the connection
AADSTS700016 app not found in tenantWrong Tenant ID or Client IDRe-check both against the app registration’s Overview page
403 Authorization_RequestDeniedAdmin consent wasn’t granted for the Graph permissionsReturn to API permissions and click Grant admin consent
Scan runs but few findingsOnly some of the permissions in step 2 were addedAdd all five and re-grant admin consent