Microsoft 365
Setup guide.

Before you start

• Microsoft 365 administrator roles are Microsoft Entra directory roles. KeySkope reads them through the Microsoft Entra ID connector; there is no separate Microsoft 365 connection and no duplicate identity records.
• Connect Microsoft Entra ID first. Microsoft 365 adds licence visibility to that same connection.

Read-only permissions

Microsoft Graph application permissions, admin-consented:

Do not grant any *.ReadWrite.* permission.

Connect Microsoft 365

1. Complete the Microsoft Entra ID setup guide.
2. On the same app registration, add Microsoft Graph application permission LicenseAssignment.Read.All and grant admin consent.
3. Run a sync of the Microsoft Entra ID connector in KeySkope. No new credential is entered.

What appears in KeySkope

• Microsoft 365 admin roles (Global, Exchange, SharePoint, Teams, User, Billing administrator and others) as privileged role grants, when directly assigned and active.
• Assigned licences as non-privileged entitlements named “M365 licence: <SKU>”.
• Not collected: sign-in activity, PIM-eligible (not yet activated) roles, administrative-unit scoping, group-based role assignment detail. Missing activity is shown as unknown, never as unused.

Verify the first sync

1. Open a known administrator in KeySkope and confirm the role matches Microsoft 365 admin center → Roles.
2. Confirm a licensed user shows the expected licence entitlement.

Troubleshooting

Official references

• List subscribedSkus
• assignedLicense resource
• About Microsoft 365 admin roles