Connect Microsoft 365

Revo reads your customers' Microsoft 365 tenants through your workspace's own multi-tenant Entra ID app, registered in your MSP's own Entra tenant. Each customer's administrator grants it read-only admin consent. Customers see your app's name on the consent screen, no customer passwords are stored, and either side can revoke access at any time.

There are two steps: set up the workspace app once (owners and admins), then connect each customer (technicians and up).

Set up the workspace app

Open Settings → Integrations → Microsoft 365.

Connect Microsoft 365

Where your Revo service offers it, Connect Microsoft 365 creates the app for you:

1. Optionally change the app name (customers see it when they approve access).
2. Click Connect Microsoft 365 and sign in with a work account that can create app registrations: a Global Administrator, Application Administrator or Cloud Application Administrator of your own tenant.
3. Accept the one prompt.

Revo registers your app with the read-only permission list, adds a client secret valid for 24 months, stores it encrypted and tests it. Your sign-in is used for that one request only and isn't stored. The card may show Finishing setup… for a short while until Microsoft activates the new app, then Ready.

Later, Renew secret and Update permissions use the same sign-in and only ever touch the app Revo created.

Set up manually instead

If Connect isn't offered, or you prefer to do it yourself, Set up manually instead walks you through four steps with a copy button for every value:

1. In the Microsoft Entra admin center, App registrations → New registration: a name your customers recognise, Accounts in any organizational directory (multitenant), and the Web redirect URI shown in Revo (it ends in /api/v1/m365/callback).
2. API permissions → Add a permission → Microsoft Graph → Application permissions: add each permission listed (all read-only). See Permissions and licences.
3. Certificates & secrets → New client secret. Copy the secret's Value (not its Secret ID) and note the expiry date.
4. In Revo, enter the client ID, secret value, your tenant ID or primary domain and the expiry, then Save and test.

Card status

Renewing a secret keeps customers connected: they approved the app, not the secret. Replace with a different client ID, or Remove, pauses every connected customer until their administrator approves the new app.

Connect a customer

1. In the customer's workspace, open Customer settings → Integrations → Microsoft 365 / Entra ID → Generate consent link.
2. Send the link to the customer's Global Administrator. It's valid for 24 hours and works once.
3. The administrator grants consent, then signs in. The sign-in confirms the tenant: the account must be a Global Administrator or Privileged Role Administrator of that same tenant.

The connection then shows connected. The first identity sync runs within the hour, or choose Sync now on the customer's Identity page. After that it syncs once a day, and security monitoring reads alerts and changes twice an hour.

What a connection feeds

• Identity pages: users, admins, licences, policies and Secure Score. See Investigating users.
• Microsoft 365 assessments: read-only configuration checks that raise findings. The first one starts on its own as soon as the customer is connected, and another runs every week (automatic assessments): you don't need to press Run.
• Alerts: Microsoft 365 alerts, risky users and sign-ins, admin role and app consent changes. See Alerts.
• Domains: the tenant's verified custom domains are added to the customer's scope, verified via Microsoft 365, and get a passive external assessment. See Scope, domain verification and authorization.
• Contacts: members with mailboxes become monitored contacts. See Customer contacts.

When new permissions are needed

When Revo adds checks that need another permission, the workspace card shows New permissions are available. Choose Update permissions (or add them to your manual app), then generate a new consent link for each customer and have their administrator approve it. Until then the affected signals show Reconnect to grant the permission; everything else keeps working.

Disconnect

Disconnecting in the customer's Integrations deletes the connection and its cached token, returns domains verified through it to unverified, and retires its contacts from monitoring. To revoke access completely, the customer also deletes your app under Enterprise applications in their Entra ID.