Microsoft 365 (Outlook) — Integration

Overview

Ingest Outlook mail and threads via Microsoft Graph. Capture headers, participants, categories, and excerpts with optional full-body storage and SecureStore attachment links.

Capabilities

• OAuth with admin consent (single-tenant or multi-tenant)

• Thread grouping; category→tag mapping

• Metadata-only, excerpt, or redacted full-body modes

• Deep link to Outlook on the web

• Role-based access and retention policies

1. 1

   Step 1

   In Chronicle, choose **Connect Microsoft 365** and sign in as a tenant admin.

   Back to top
2. 2

   Step 2

   Grant Graph API read scope for mail.

   Back to top
3. 3

   Step 3

   Pick mailboxes to ingest or enable organization-wide sync.

   Back to top
4. 4

   Step 4

   Map Outlook categories to Chronicle tags (optional).

   Back to top
5. 5

   Step 5

   Start ingestion and monitor status in the connectors dashboard.

   Back to top

Limitations

• Some categories require EWS/Graph parity; we rely on Graph-supported fields.

• Tenant policies (e.g., Conditional Access) must allow the connector scopes.

FAQs

Pricing