Skip to content
ISE

Microsoft 365

The Microsoft 365 integration is read-only by design: it watches what Microsoft reports about your tenant. M365 services appear in the estate, service-health incidents arrive as signals that clear when Microsoft resolves them, and licensing is watched by ISE’s own detectors — because Microsoft raises no alarm before a licence pool runs dry. The action catalogue is deliberately empty.

Capabilities

Section titled “Capabilities”

Discovery. The tenant’s M365 services (Exchange Online, SharePoint, Teams, and the rest of the service-health overview) are enumerated into the estate as third-party service entities.

Alerts. Microsoft Service Health issues are forwarded as alert signals with their classification mapped onto the canonical ladder. They are stateful: a signal stays open until Microsoft marks the issue resolved, then recovers — no arbitrary time window.

Observations. Licensing gets ISE’s own deterministic detectors: a licence pool ≥90% consumed, or a subscription in warning/suspended state, raises an observation. Licence counts are shown on the System card.

Evidence. On demand during an investigation: service_health_issue (full detail including Microsoft’s post-incident report), message_center (change announcements — deliberately pull-only, never a signal source), and license_detail.

Actions. None, ever, by design — service health gives nothing to act on, so the integration carries no write credential at all.

Setup

Section titled “Setup”
  1. Create a dedicated read app registration with admin-consented, read-only Graph application permissions: ServiceHealth.Read.All and Organization.Read.All. Use a separate app registration from the Entra ID integration — separate consent and revocation keep the two operationally independent.
  2. In ISE, add a Microsoft 365 integration (Settings → Integrations) with tenant ID, client ID, and client secret. The secret is encrypted at rest and redacted from logs.
  3. The health check verifies the principal; the System card shows open service issues and licence utilisation.

The integration works standalone — Entra ID need never be configured. If both are connected, their views join up opportunistically in the estate; neither requires the other.

Examples

Section titled “Examples”

A service incident, before the tickets arrive. Microsoft reports degraded mail flow in Exchange Online. The signal opens an incident on the Exchange service entity — visible on the pane of glass before users start reporting it — and pulls the full advisory, including workarounds, as evidence. When Microsoft resolves the issue, the signal recovers and the incident closes.

Licence exhaustion caught early. The E3 pool crosses 90% consumed. ISE raises an observation — there is no Microsoft alert for this — so procurement starts before onboarding is blocked. license_detail evidence shows exactly which SKUs are close to the line.