> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/integrations/saas-applications/microsoft-365.md). # Microsoft 365 Discover users, track license assignments, and monitor sign-in and app activity across your Microsoft 365 tenant Microsoft 365 is Microsoft's cloud-based productivity suite, encompassing Office apps, Exchange, Teams, SharePoint, and more. Connecting Microsoft 365 to Harmony gives IT teams full visibility into user accounts, license assignments, and sign-in activity - making it easy to manage access, optimize license spend, and stay on top of account hygiene. {% hint style="info" %} This integration is read-only. Harmony pulls data from Microsoft 365 but does not make changes to your tenant. {% endhint %} #### What the Microsoft 365 integration enables | Capability | Description | | -------------------- | ----------------------------------------------------------------------------------- | | User Discovery | Automatically surface all M365 users in Harmony's employee directory | | License Tracking | See which licenses are assigned to each user across all M365 products | | Sign-In Monitoring | Collect successful sign-in events from your Microsoft Entra ID sign-in logs | | App Usage Activity | Track per-user activity across Outlook, Teams, Word, Excel, PowerPoint, and OneNote | | License Optimization | Spot licensed users with little or no recent activity so you can reclaim seats | *** #### Prerequisites 1. **Microsoft 365 subscription** - an active Microsoft 365 tenant 2. **A Microsoft Entra ID administrator** who can grant tenant-wide admin consent - **Global Administrator** is always sufficient. Privileged Role Administrator and Cloud Application Administrator can also grant consent in most tenants. A Global Reader or User Administrator **cannot** complete this flow 3. **Microsoft Entra ID P1 or P2** (optional) - required for sign-in log data. Without it, user, license, and app activity data still sync 4. **A Harmony account** with admin privileges *** #### Connect Microsoft 365 to Harmony **Step 1: Navigate to Integrations** 1. Log in to your Harmony dashboard 2. Go to **Settings** > **Integrations** 3. Find **Microsoft 365** under **SaaS Applications** and click **Connect** **Step 2: Sign in with Microsoft** 1. You will be redirected to Microsoft to authorize the connection 2. Sign in with an account that can grant tenant-wide admin consent (see [Prerequisites](#prerequisites)) 3. Review the requested permissions (see [Permissions Explained](#permissions-explained) below) and click **Accept** **Step 3: Confirm the connection** 1. After you accept, you are returned to Harmony and Microsoft 365 shows as connected 2. Harmony begins the initial sync automatically - there is no additional configuration to fill in {% hint style="warning" %} **Check your Reports privacy setting** By default, Microsoft 365 conceals usernames in its usage reports, which is what Harmony uses for Outlook, Teams, and per-app activity. Harmony automatically restores the real user for most concealed rows, but any row it cannot resolve leaves that user's activity unattributed. To get complete attribution, go to the **Microsoft 365 admin center** > **Settings** > **Org settings** > **Reports** and turn off the option that displays concealed (anonymized) user names. {% endhint %} *** #### Disconnect Microsoft 365 from Harmony 1. Log in to your Harmony dashboard 2. Go to **Settings** > **Integrations** 3. Find **Microsoft 365** under **SaaS Applications** and click the integration card 4. Click **Disconnect** 5. Confirm the disconnection when prompted Once disconnected, Harmony stops syncing data from Microsoft 365. Previously synced data remains available in Harmony. *** #### What Harmony Syncs | Data | Description | | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | User accounts | Display name, email, user principal name, account enabled/disabled status, and user type (Member or Guest) | | Profile attributes | Department, job title, account created date, and last password change date | | License assignments | The product licenses assigned to each user, resolved from Microsoft SKU identifiers to readable product names | | Enabled services | Which Microsoft 365 services are active on the user's licenses (for example Exchange and Microsoft Teams) | | Sign-in events | Successful sign-in events from your Microsoft Entra ID sign-in logs, with application, IP address, device, location, conditional access status, and risk details | | Per-app activity | Daily per-user activity for Outlook, Microsoft Teams, Word, Excel, PowerPoint, and OneNote | | Outlook email activity | Daily per-user send, receive, and read counts, plus meetings created and meetings interacted with | | Teams activity | Daily per-user channel and private chat messages, calls, meetings organized and attended, and audio, video, and screen-share durations | | Tenant identity | Your Microsoft 365 organization ID, used to group all synced records under a single account | {% hint style="info" %} **Where to find Microsoft 365 data in Harmony:** * **Applications** - Microsoft 365 appears as a discovered application with license and usage details. Outlook and Microsoft Teams additionally appear as their own applications for users whose licenses enable those services * **People** - Each employee's profile shows their Microsoft 365 license, department and job title, sign-in activity, and per-user app usage {% endhint %} {% hint style="info" %} **Sync cadence and history:** * User inventory and sign-in events refresh every 6 hours * Activity reports refresh daily * On first connection, Harmony pulls up to 90 days of sign-in events (bounded by your tenant's Microsoft Entra ID sign-in log retention period) and about 27 days of activity report history, which is the maximum Microsoft's daily usage reports allow {% endhint %} *** #### Permissions Explained Harmony connects using a Microsoft Entra ID application with read-only Microsoft Graph **application permissions**. Because they are application permissions, they are granted once for the whole tenant at the admin consent screen rather than per user. | Permission | Purpose | | ----------------------------------------------- | --------------------------------------------------------------------------------------------------- | | `User.Read.All` or `Directory.Read.All` | List users and read their profile attributes, account status, and assigned licenses | | `Organization.Read.All` or `Directory.Read.All` | Read your tenant identity and the tenant's subscribed license SKUs so license names can be resolved | | `AuditLog.Read.All` | Read sign-in events from the Microsoft Entra ID sign-in logs | | `Reports.Read.All` | Read Microsoft 365 usage reports for Outlook, Teams, and per-app activity | {% hint style="info" %} The Microsoft consent screen shows the exact list of permissions being requested. Review it there before accepting - Harmony requests read access only and never writes to your tenant. {% endhint %} *** #### Supported License Types Harmony resolves Microsoft's license SKU identifiers into readable product names using a built-in catalog of over 460 Microsoft 365, Office 365, Enterprise Mobility + Security, Power Platform, Teams, and Windows/Cloud PC SKUs. If a SKU is not in the catalog, Harmony still records the license and displays its raw Microsoft SKU identifier. As Microsoft introduces new license SKUs, Harmony continues to expand coverage to ensure your license data stays accurate and complete. *** #### Use Cases
License Spend Optimization Identify users holding paid Microsoft 365 licenses with little or no recent app activity and reclaim those seats. Microsoft's usage reports cover the past 30 days, and Harmony backfills about 27 days of activity on the first sync, so a full activity picture builds up over the first month.
Offboarding Verification Confirm that M365 licenses and accounts have been properly disabled or removed as part of offboarding workflows
Account Hygiene Surface stale or inactive accounts for review and remediation before they become a security risk
License Audit Generate reports on license allocation across the org for procurement planning and compliance purposes
*** #### Troubleshooting
Connection fails at the Microsoft consent screen **Possible causes:** * The signed-in account cannot grant tenant-wide admin consent. Global Reader and User Administrator are not sufficient **Solutions:** 1. Retry the connection with a **Global Administrator** account, or another role your tenant permits to grant tenant-wide admin consent 2. Confirm your tenant does not restrict admin consent to Global Administrators only
No sign-in activity is appearing **Possible causes:** * The tenant does not have a Microsoft Entra ID P1 or P2 license, which Microsoft requires for sign-in log access * The sign-in events predate your tenant's Microsoft Entra ID sign-in log retention period **Solutions:** 1. Verify your Microsoft Entra ID plan in the Microsoft Entra admin center 2. Sign-in events older than your tenant's retention period are not available through the Microsoft Graph API - this is a Microsoft platform limitation. User and license data continue to sync regardless
Activity data is missing for some users **Possible causes:** * Microsoft 365 is concealing usernames in usage reports, and some rows could not be matched back to a user * Only successful sign-ins are collected, so failed sign-in attempts do not appear **Solutions:** 1. In the **Microsoft 365 admin center**, go to **Settings** > **Org settings** > **Reports** and turn off concealed user names 2. Activity data covers Outlook, Microsoft Teams, Word, Excel, PowerPoint, and OneNote. Users with no activity in those apps on a given day do not appear in that day's report
Data is not appearing after connection **Possible causes:** * The initial sync has not completed yet * Microsoft's usage reports are published on a delay, so the most recent day or two of activity may not be available yet **Solutions:** 1. Allow the initial sync to complete - user inventory and sign-in events refresh every 6 hours and activity reports refresh daily 2. Verify the integration still shows as connected under **Settings** > **Integrations**
*** #### Data & Privacy
Key privacy principles For information about how Harmony handles your data, see our [Privacy Policy](https://harmony.io/privacy). * Harmony accesses Microsoft 365 data in read-only mode and does not modify any data in your tenant * Harmony requests read-only Microsoft Graph application permissions only * The integration can be revoked at any time from Harmony settings or from the Microsoft Entra admin center
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.harmony.io/integrations/saas-applications/microsoft-365.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.