Integrations & Modules

1Security connects once, to your Microsoft 365 tenant, and reads across the whole estate: identities, devices, sites, files, mail, apps, AI agents and activity. Everything lands in one model, so a question that normally spans five admin portals becomes one row in one screen.

Two principles shape how that works:

• Least privilege by default. The base install is entirely read-only. Nothing writes to your tenant until you explicitly enable a write module.
• Modules, not a monolith. Each extra capability is a separate consent you grant only if you want the feature - and each one degrades on its own if you don't.

---

TL;DR - what's covered, at a glance

Coverage map

What the stitching actually buys you

Each Microsoft surface answers a narrow question well. The answers only become security when they're joined:

• Entra says the account exists. 1Security says what it can reach, through every group, link and inherited permission.
• Intune says the device is compliant. 1Security says which files that device touched - and surfaces the unregistered and shadow devices Intune's model can't see at all, because they never enrolled.
• SharePoint says a link exists. 1Security says who is on the other end of it, including external people who never became a directory object.
• Copilot says the agent has Sites.Read.All. 1Security says what that means in files, and which of them contain regulated data.
• The audit log says an action happened. 1Security says where from, on what device, by whom, to which sensitive file - one row, not four exports.

---

Core visibility (default)

The base installation is read-only and covers everything in the map above except the modules listed in the next section. Out of the box you get:

• Permission Graph - a fully interactive tenant map of users, groups, applications, agents, devices, sites and files, with effective access resolved through nested groups, sharing links and app grants.
• Activity & risk monitoring - Entra sign-in logs and, once the audit module is on, the full unified audit log, with location intelligence and anomaly detection on top.
• Built-in sensitivity - 1Security's own text-extraction and OCR engine scans file contents for 300+ sensitive patterns without requiring Purview or Exchange access.
• Devices - discovery of registered, unregistered and shadow devices, reconstructed from real activity rather than only from the directory.
• Agents - every Entra-backed AI agent, its permissions, and its real data reach.

---

Extension modules

Enable these from Settings → Integrations. Each requests its own localized set of permissions, and each is independent: skipping one costs you that feature and nothing else.

1. Audit log (Unified Audit Log)

Turns Microsoft's activity record into a queryable, attributed history.

• Why it requires an extension: uses the Office 365 Management API activity feed, and assigns the Exchange Administrator role to 1Security's own service principal so it can read the audit configuration through Exchange Online.
• Benefits: up to three years of activity, well past Microsoft's default retention, across SharePoint, OneDrive, Teams, Exchange and Entra - attributed to the user, device, location and file involved. This is the feed behind Activity Logs, Locations, Anomalies and every log-fed trend.

2. Sensitivity (1Security engine + Microsoft Purview)

1Security includes a built-in sensitivity engine that classifies data across your environment using text extraction, OCR for images and pattern matching, detecting 300+ types of sensitive information without advanced Microsoft licenses. This module extends that by integrating with Microsoft Purview Information Protection.

• Why it requires an extension: needs permission to read your tenant's Purview configuration and label taxonomy, plus membership of the Content Explorer List Viewer role group.
• Benefits: a hybrid classification layer. Your custom Purview labels and Microsoft's SIT detections sit alongside 1Security's independent findings, so you keep the labels you invested in even if Purview autodiscovery isn't licensed - and you get a second opinion where it is.

3. Conditional Access

Compares the Conditional Access you declared in Entra with the sign-ins actually observed.

• Why it requires an extension: needs Policy.Read.All to read named locations and policy configuration. It rides a re-consent of the read-only app you already granted, not a new registration. The per-sign-in verdict is free - it already travels inside the sign-in records 1Security ingests.
• Benefits: finds the places nobody governs, trusted ranges that resolve to VPN or hosting infrastructure, and sign-ins that completed with no policy in force at all. Requires Entra ID P1 on your side, because that's what Conditional Access itself requires. See Conditional Access.

4. Copilot agents (Microsoft Agent 365)

Unlocks Microsoft's declarative agent catalog on top of the Entra agents already scanned by default.

• Why it requires an extension: reads the Copilot package catalog with a delegated admin token, so Microsoft validates the license of the single admin who connects the tenant.
• Benefits: SharePoint agents, Teams extensions and third-party Copilot wrappers stop looking like ordinary enterprise apps and become governed agent records with quantified reach. One standalone Agent 365 license on that one admin unlocks the whole tenant's catalog. Details in Agents.

5. Email (Microsoft Exchange)

Expands the platform to analyze email traffic and mailbox contents.

• Why it requires an extension: requires explicit read access to mailbox contents, message bodies and attachments.
• Benefits: detects sensitive data shared via email, analyzes attachments in transit, reconstructs conversation threads, and maps outbound flows - like forwarding sensitive data externally - into the same permission graph as files. Bodies and attachments are read during analysis, not stored; see Data Handling.

6. Mailbox management (optional, write)

• Why it requires an extension: the first of two modules that request write permission, granted separately from email visibility - you can read mailboxes without ever allowing changes.
• Benefits: lets an automation quarantine or flag a message instead of only alerting on it. No permanent deletion.

7. Automations (optional, write)

Turns 1Security from an auditing platform into a security orchestrator.

• Why it requires an extension: the only module that can change permissions in your Microsoft 365 tenant.
• Benefits: manage access at scale - revoke stale external access, expire widely-shared sensitive links, remove overprivileged Copilot agents, reclaim licenses and remediate permission sprawl across thousands of files at once. Every action is staged behind review queues and grace periods; see Automations.

---

Choosing what to enable

Exact permission scopes, the admin roles involved, license prerequisites and what breaks without each one are documented in Requirements.