---
title: Integrations & Modules
description: One connection to Microsoft 365, every surface in one map - Entra, SharePoint, OneDrive, Teams, Exchange, Intune, Azure, Copilot and the audit log - plus the opt-in modules that extend it.
icon: Puzzle
---

1Security connects **once**, to your Microsoft 365 tenant, and reads across the whole estate: identities, devices, sites, files, mail, apps, AI agents and activity. Everything lands in one model, so a question that normally spans five admin portals becomes one row in one screen.

Two principles shape how that works:

- **Least privilege by default.** The base install is entirely **read-only**. Nothing writes to your tenant until you explicitly enable a write module.
- **Modules, not a monolith.** Each extra capability is a separate consent you grant only if you want the feature - and each one degrades on its own if you don't.

---

## TL;DR - what's covered, at a glance

<Cards>
  <Card
    title="One source of truth for Microsoft 365"
    description="Entra, SharePoint, OneDrive, Teams, Exchange, Intune, Azure and Copilot stop being separate inventories. One identity, one device, one file, one story."
  />
  <Card
    title="Read-only to start"
    description="Core visibility asks for read scopes only. Write access exists in exactly two optional modules, and both stage their actions behind review."
  />
  <Card
    title="No agent, no appliance, no E5"
    description="Nothing to install and nothing to forward. The core product runs on a standard Microsoft 365 license with SharePoint Online."
  />
  <Card
    title="The value is the stitching"
    description="Microsoft gives you the pieces. 1Security joins them: this user, on this unmanaged device, from this country, opened this labelled file that this agent can also read."
  />
</Cards>

### Coverage map

| Microsoft surface         | What 1Security reads                                                                                                                                           | Where it shows up                                                                                                                    |
| :------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------------------------------------------------- |
| **Entra ID**              | Users, guests, groups, nested membership, directory roles, MFA registration, service principals, sign-in logs, devices, [Agent ID](/en/docs/agents) identities | [Users](/en/docs/screens/users), [Groups](/en/docs/screens/groups), [Apps](/en/docs/screens/apps), [Agents](/en/docs/screens/agents) |
| **SharePoint Online**     | Sites, subsites, hub sites, libraries, files, site-collection permissions and inheritance, sharing links, SharePoint groups and SharePoint-only guests         | [Sites](/en/docs/screens/sites), [Files](/en/docs/screens/files), [Permission Graph](/en/docs/permission-graph)                      |
| **OneDrive for Business** | Every personal drive as a first-class site, its files, and the links users created from it                                                                     | [Sites](/en/docs/screens/sites), [Files](/en/docs/screens/files)                                                                     |
| **Microsoft Teams**       | Teams-connected groups, channels and their channel files, plus Teams resource-specific consent (RSC) grants held by apps and agents                            | [Groups](/en/docs/screens/groups), [Files](/en/docs/screens/files), [Apps](/en/docs/screens/apps)                                    |
| **Microsoft Intune**      | Compliance state, management state, ownership and trust type on every registered device, read straight from Microsoft                                          | [Devices](/en/docs/screens/devices)                                                                                                  |
| **Azure / app platform**  | Enterprise applications, app registrations, service principals, managed identities, OAuth scopes and consent grants, Azure AI Foundry agents                   | [Apps](/en/docs/screens/apps), [Agents](/en/docs/screens/agents)                                                                     |
| **Microsoft Copilot**     | Declarative agents and their blueprints, knowledge sources, capabilities and declared permissions                                                              | [Agents](/en/docs/screens/agents)                                                                                                    |
| **Unified Audit Log**     | Every recorded action across SharePoint, OneDrive, Teams, Exchange and Entra, up to three years back                                                           | [Activity Logs](/en/docs/screens/activity-logs), [Locations](/en/docs/location), [Anomalies](/en/docs/screens/anomalies)             |
| **Microsoft Purview**     | Sensitivity labels and Sensitive Information Type detections                                                                                                   | [Sensitivity Labels](/en/docs/screens/sensitivity-labels), [Sensitive Info](/en/docs/screens/sensitive-info)                         |
| **Microsoft Defender**    | Security alerts and incidents, merged with 1Security's own detections                                                                                          | [Users](/en/docs/screens/users), resource drawers                                                                                    |
| **Exchange Online**       | Mailboxes, messages, attachments, recipients and accepted domains                                                                                              | [Email](/en/docs/screens/email)                                                                                                      |
| **Licensing**             | Subscribed SKUs and per-user assignment, including unused and orphaned seats                                                                                   | [Licenses](/en/docs/screens/licenses)                                                                                                |

<Callout type="info">
  Everything above is read through Microsoft's own APIs, so what you see always
  agrees with the portals your admins already use. 1Security doesn't replace
  Entra, Intune or Purview - it joins them and adds the layer none of them have:
  effective access.
</Callout>

### What the stitching actually buys you

Each Microsoft surface answers a narrow question well. The answers only become security when they're joined:

- Entra says the account exists. **1Security says what it can reach**, through every group, link and inherited permission.
- Intune says the device is compliant. **1Security says which files that device touched** - and surfaces the unregistered and shadow devices Intune's model can't see at all, because they never enrolled.
- SharePoint says a link exists. **1Security says who is on the other end of it**, including external people who never became a directory object.
- Copilot says the agent has `Sites.Read.All`. **1Security says what that means in files**, and which of them contain regulated data.
- The audit log says an action happened. **1Security says where from, on what device, by whom, to which sensitive file** - one row, not four exports.

---

## Core visibility (default)

The base installation is **read-only** and covers everything in the map above except the modules listed in the next section. Out of the box you get:

- **Permission Graph** - a fully interactive tenant map of users, groups, applications, agents, devices, sites and files, with **effective** access resolved through nested groups, sharing links and app grants.
- **Activity & risk monitoring** - Entra sign-in logs and, once the audit module is on, the full unified audit log, with location intelligence and anomaly detection on top.
- **Built-in sensitivity** - 1Security's own text-extraction and OCR engine scans file contents for 300+ sensitive patterns without requiring Purview or Exchange access.
- **Devices** - discovery of registered, unregistered and **shadow** devices, reconstructed from real activity rather than only from the directory.
- **Agents** - every Entra-backed AI agent, its permissions, and its real data reach.

<Callout type="warn">
  The read-only module does request SharePoint's `Sites.FullControl.All`,
  because SharePoint offers no read-only scope that exposes site-collection
  sharing settings and permission inheritance - the data the permission graph is
  built from. It is only ever used for read calls. The full scope list,
  permission by permission, is in
  [Requirements](/en/docs/requirements#permissions-module-by-module).
</Callout>

---

## Extension modules

Enable these from **Settings → Integrations**. Each requests its own localized set of permissions, and each is independent: skipping one costs you that feature and nothing else.

### 1. Audit log (Unified Audit Log)

Turns Microsoft's activity record into a queryable, attributed history.

- **Why it requires an extension**: uses the Office 365 Management API activity feed, and assigns the Exchange Administrator role to 1Security's **own** service principal so it can read the audit configuration through Exchange Online.
- **Benefits**: up to three years of activity, well past Microsoft's default retention, across SharePoint, OneDrive, Teams, Exchange and Entra - attributed to the user, device, location and file involved. This is the feed behind [Activity Logs](/en/docs/screens/activity-logs), [Locations](/en/docs/location), [Anomalies](/en/docs/screens/anomalies) and every log-fed trend.

<Callout type="info">
  The **unified audit log must be enabled in your tenant** for any of this to
  exist. It's on by default in most tenants; 1Security checks and can turn it on
  for you once this module is connected.
</Callout>

### 2. Sensitivity (1Security engine + Microsoft Purview)

1Security includes a built-in sensitivity engine that classifies data across your environment using text extraction, OCR for images and pattern matching, detecting 300+ types of sensitive information without advanced Microsoft licenses. **This module extends that** by integrating with Microsoft Purview Information Protection.

- **Why it requires an extension**: needs permission to read your tenant's Purview configuration and label taxonomy, plus membership of the **Content Explorer List Viewer** role group.
- **Benefits**: a hybrid classification layer. Your custom Purview labels and Microsoft's SIT detections sit alongside 1Security's independent findings, so you keep the labels you invested in even if Purview autodiscovery isn't licensed - and you get a second opinion where it is.

### 3. Conditional Access

Compares the Conditional Access you declared in Entra with the sign-ins actually observed.

- **Why it requires an extension**: needs `Policy.Read.All` to read named locations and policy configuration. It rides a re-consent of the read-only app you already granted, not a new registration. The per-sign-in verdict is free - it already travels inside the sign-in records 1Security ingests.
- **Benefits**: finds the places nobody governs, trusted ranges that resolve to VPN or hosting infrastructure, and sign-ins that completed with **no policy in force at all**. Requires Entra ID P1 on your side, because that's what Conditional Access itself requires. See [Conditional Access](/en/docs/conditional-access).

### 4. Copilot agents (Microsoft Agent 365)

Unlocks Microsoft's declarative agent catalog on top of the Entra agents already scanned by default.

- **Why it requires an extension**: reads the Copilot package catalog with a **delegated** admin token, so Microsoft validates the license of the single admin who connects the tenant.
- **Benefits**: SharePoint agents, Teams extensions and third-party Copilot wrappers stop looking like ordinary enterprise apps and become governed agent records with quantified reach. **One** standalone Agent 365 license on that one admin unlocks the whole tenant's catalog. Details in [Agents](/en/docs/agents).

### 5. Email (Microsoft Exchange)

Expands the platform to analyze email traffic and mailbox contents.

- **Why it requires an extension**: requires explicit read access to mailbox contents, message bodies and attachments.
- **Benefits**: detects sensitive data shared via email, analyzes attachments in transit, reconstructs conversation threads, and maps outbound flows - like forwarding sensitive data externally - into the same permission graph as files. Bodies and attachments are read during analysis, not stored; see [Data Handling](/en/docs/data-handling).

### 6. Mailbox management (optional, write)

- **Why it requires an extension**: the first of two modules that request **write** permission, granted **separately** from email visibility - you can read mailboxes without ever allowing changes.
- **Benefits**: lets an automation quarantine or flag a message instead of only alerting on it. No permanent deletion.

### 7. Automations (optional, write)

Turns 1Security from an auditing platform into a security orchestrator.

- **Why it requires an extension**: the only module that can change permissions in your Microsoft 365 tenant.
- **Benefits**: manage access at scale - revoke stale external access, expire widely-shared sensitive links, remove overprivileged Copilot agents, reclaim licenses and remediate permission sprawl across thousands of files at once. Every action is staged behind review queues and grace periods; see [Automations](/en/docs/screens/automations).

---

## Choosing what to enable

<Callout type="info">
  A common rollout: start read-only, add the **audit log** module on day one
  (Microsoft records nothing while it's off, and no tool can recover that period
  afterwards), then add **Purview** and **Email** as your data-protection scope
  grows. Leave the two write modules until you've reviewed what 1Security found
  and know exactly what you want it to fix.
</Callout>

Exact permission scopes, the admin roles involved, license prerequisites and what breaks without each one are documented in [Requirements](/en/docs/requirements).