> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/data-security-posture-management/prisma-cloud-dspm-deployment/deploy-prisma-cloud-dspm-on-microsoft-365/onboarding-microsoft-365.md).

# Onboarding Microsoft 365

### Architecture

The image below depicts the deployment architecture.

![](/files/bEYttZ6N89brdmjSpDQF)

### Roles and Permissions

Below is a list of the roles Prisma Cloud DSPM uses to access your environment and the permissions they have. Permissions are used to access different types of data, or perform actions such as creating/deleting virtual machines (VMs), exporting snapshots, etc.

IMPORTANT

If your Microsoft 365 account has any firewall or network restrictions in place, it is imperative to grant access to the following Prisma Cloud DSPM IP addresses:

**EU:**

* 52.48.123.3
* 99.80.210.235
* 34.247.249.123

**USA:**

* 54.225.205.121
* 18.214.146.232
* 3.93.120.3

**Environment**

**Permissions**

**Description**

Prisma Cloud DSPM (External)

User.Read.All (Graph)

Identify guest users (future risks)

Prisma Cloud DSPM (External)

Group.Read.All (Graph)

Identify the groups containing guest users (future risks)

Prisma Cloud DSPM (External)

Directory.Read.All (Graph)

Retrieve domain information

Prisma Cloud DSPM (External)

Application.Read.All (Graph)

Identify application permissions (future risks)

Prisma Cloud DSPM (External)

Sites.Read.All (Graph)

Discover all sites

Prisma Cloud DSPM (External)

Sites.Read.All (SharePoint API)

Get site configurations

Prisma Cloud DSPM (External)

Sites.Manage.All (SharePoint API)

Get site’s external sharing configuration to identify publicly exposed files

Prisma Cloud DSPM (External)

Files.Read.All (Graph)

Read metadata on files including MIP labels

Prisma Cloud DSPM (External)

SharePointTenantSettings.Read.All (Graph)

Read org-level config for External Sharing

Prisma Cloud DSPM (External)

InformationProtectionPolicy.Read.All (Graph)

Read MIP labels policies

Customer (Internal)

Files.Read.All (Graph)

Classification

Customer (Internal)

Sites.Read.All (Graph)

Classification

Customer (Internal)

Content.SuperUser (RMS)

Read RMS encrypted files (future)

### Prerequisites

* Prisma Cloud DSPM Orchestrator must be deployed in the same Azure tenant where the Microsoft 365 domain is hosted.
* The user running the script must have the Application.ReadWrite.All permission.

### Onboarding Steps

1. Sign in to your Prisma Cloud DSPM account.
2. From the left menu, select Settings.
3. Under Integrations, go to the Microsoft 365 option, and click Configure.
4. Click Add New.
5. In the Microsoft 365 Connect New Subscription window, do the following:
   * Enter the required details.
   * Select the orchestrator and the region
   * Choose the environment type)
6. Grant approval for the enterprise application. Ensure that you are signed in to the tenant associated with the Microsoft 365 instance you wish to onboard. This tenant should also correspond to the one in which the Orchestrator was deployed.
7. The Approval screen opens in a new tab. Follow the provided steps until you reach the Success screen.
8. In Prisma Cloud DSPM, choose the Enable option (step 3).
9. Copy the provided PowerShell script and execute it in the [Azure PowerShell console](http://shell.azure.com).
10. Wait until the script successfully completes, and return to Prisma Cloud DSPM.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/data-security-posture-management/prisma-cloud-dspm-deployment/deploy-prisma-cloud-dspm-on-microsoft-365/onboarding-microsoft-365.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.