Beta Microsoft 365 Custom Client Credentials

Important:This custom integration for Microsoft 365 Client Credentials is in beta release.

This custom integration can pull data for Microsoft 365 tenants located on different cloud environments. With this integration, you can create a single connection to your Microsoft 365 subscription that includes Office 365, Dynamics 365, Power BI, Project, Visio, and any future applications added by Microsoft.

The following sections explain prerequisites, resources, and instructions for integrating with SaaS Management.

•

Stored Information for Beta Microsoft 365 Custom Client Credentials

•

Required Minimum Permissions for Beta Microsoft 365 Custom Client Credentials

•

Authentication Method for Beta Microsoft 365 Custom Client Credentials

•

Required Credentials for Beta Microsoft 365 Custom Client Credentials

•

Beta Microsoft 365 Custom Client Credentials License Types

•

Obtaining Client Credentials, Directory (Tenant) ID, Microsoft Graph URL, and Access Token URL for Beta Microsoft 365 Custom Client Credentials

•

Integrating Beta Microsoft 365 Custom Client Credentials With SaaS Management

•

Auto-Populated License Information for Beta Microsoft 365 Custom Client Credentials

•

Managing Available Licenses for Beta Microsoft 365 Custom Client Credentials

•

API Endpoints for Beta Microsoft 365 Custom Client Credentials

Stored Information for Beta Microsoft 365 Custom Client Credentials

The following table describes the available integration tasks and stored data within SaaS Management.

Available Integration Tasks

Information Stored

Application Roster

•

First Name

•

Last Name

•

UPN (User Principal Name)

•

Active Date

•

Deactivated Date

•

Licenses

•

Block Credentials

•

Is MFA Turned On

•

Last Used M365 Application

•

Note:Some fields may not be available due to cloud deployment limitations.

Application Access

Last Activity Date of the following applications:

•

Dynamics 365

•

Microsoft Exchange Server

•

Microsoft Teams

•

OneDrive

•

Outlook

•

Power BI

•

Project

•

SharePoint

•

Skype for Business

•

Visio

•

Yammer

Note:Consider the following:

•

Application Access integration task data for Microsoft Exchange Server, Microsoft Teams, OneDrive, Outlook, SharePoint, Skype for Business, and Yammer is available 3 days after the event(s) occurs. Therefore, the application access data in the Microsoft Portal may not match the data in SaaS Management.

•

When the Application Access integration task is first run, it pulls all the Microsoft 365 active users and the Outlook activity report but only the last 30 days of sign-in events for Dynamics 365, Power BI, Project, and Visio due to a Microsoft data limitation. For more information, see Microsoft’s documentation topic, How Long Does Microsoft Entra ID Store the Data?

•

Some fields may not be available due to cloud deployment limitations.

License Differentiation

See Beta Microsoft 365 Custom Client Credentials License Types and Tracking Application Activity by License Type for License Differentiation.

License Information

•

License Name

•

License Type

•

Purchased Quantity

Note:The SaaS Management License Information integration task retrieves information once every 24 hours. Therefore, the data in the Microsoft Portal may not match the data in SaaS Management.

Note:The information stored is subject to change as enhancements are made to the SaaS application.

Required Minimum Permissions for Beta Microsoft 365 Custom Client Credentials

The minimum API required permissions are based on the Required Application Permissions for Beta Microsoft 365 Custom Client Credentials and the Required User Roles for Beta Microsoft 365 Custom Client Credentials.

Required Application Permissions for Beta Microsoft 365 Custom Client Credentials

Application Permission	Description	Integration Task Name
AuditLog.Read.All	Enables you to read the user sign ins for your tenant.	Application Access Application Roster
Reports.Read.All	Enables you to read the user access event details in your Microsoft account.	Application Access
UserAuthenticationMethod.Read.All	Is required for retrieving the multifactor authentication details for the user.	Application Roster
Directory.Read.All and Reports.Read.All	Enables you to read the list of users in your Microsoft account.	Application Roster License Information

Required User Roles for Beta Microsoft 365 Custom Client Credentials

Note:The following SaaS application user roles are not applicable to Flexera One roles.

User Role	Description
Global Administrator	To grant the application permissions, the user must have Global Administrator access. For more information, see Microsoft’s documentation topic, Microsoft Entra Built-In Roles.

Authentication Method for Beta Microsoft 365 Custom Client Credentials

The required authentication method is OAuth 2.0 With Client Credentials. For more information, see Microsoft’s documentation topic, Microsoft Identity Platform and the OAuth 2.0 Client Credentials Flow.

Required Credentials for Beta Microsoft 365 Custom Client Credentials

The following credentials are required to integrate with SaaS Management.

•

Application (Client) ID

•

Client Secrets Value

•

Directory (Tenant) ID

•

Access Token URL

•

Microsoft Graph URL

Beta Microsoft 365 Custom Client Credentials License Types

To learn more about the product names and service plan identifiers for Microsoft 365 licenses, see Microsoft’s documentation topic, Product Names and Service Plan Identifiers for Licensing.

Obtaining Client Credentials, Directory (Tenant) ID, Microsoft Graph URL, and Access Token URL for Beta Microsoft 365 Custom Client Credentials

Before Integrating Beta Microsoft 365 Custom Client Credentials With SaaS Management, you need to obtain the client credentials, directory (tenant) ID, Microsoft Graph URL, and Access Token URL by completing the following steps.

To obtain Client Credentials, Directory (Tenant) ID, Microsoft Graph URL, and Access Token URL:

In the Search box at the top of the page, enter App registrations and click App registrations in the search results to select it. The App registrations page opens.

Click New Registration. The Register an application page opens.

Enter a Name and choose the Accounts in this organizational directory only option.

Click Register.

On the Overview tab, copy and paste the Application (client) ID and the Directory (tenant) ID to a file. You will later enter these values in SaaS Management.

To generate a client secrets value, do the following:

Click the Certificates & secrets tab.

Under Client secrets, click New client secret. The Add a client secret dialog box opens.

In the Description field, enter a name for the new secret.

Under Expires, choose an expiration value.

Click Add.

Under Client secrets, copy and paste the client secret value to a file. You will later enter this value in SaaS Management.

Click the API permissions tab and complete the following:

Click Microsoft Graph. The Request API permissions panel opens.

Click Application permissions.

Note:Do not select Delegated permissions. Delegated permissions will not work.

In the Select permissions search box, enter Directory, and then click the arrow to expand Directory and select the Directory.Read.All permission checkbox.

In the Select permissions search box, enter Reports. Then click the arrow to expand Reports and select the Reports.Read.All permission checkbox.

Click Update permissions.

In the Select permissions search box, enter AuditLog. Click the arrow to expand AuditLog, and select the AuditLog.Read.All permission checkbox.

To obtain the Access Token URL:

Go to the Microsoft Help topic App registration and token service root endpoints.

Copy the Microsoft Entra ID endpoint URL for the National cloud that you want to integrate. For example, if you want to integrate the tenant of Azure global service Cloud, copy only login.microsoftonline.com and not the https:// of the URL.

10.

To obtain the Microsoft Graph URL:

Go to the Microsoft Help topic Microsoft Graph and Graph Explorer service root endpoints.

Copy the Microsoft Graph URL for the National cloud that you want to integrate. For example, if you want to integrate the tenant of Microsoft Graph global service Cloud, copy only graph.microsoft.com and not the https:// of the URL.

11.

After the permissions are added, grant admin consent.

Important:If you modify any permissions in the Microsoft Azure Portal that are used to create the directory (tenant) ID and client secrets value, you need to reauthorize the Microsoft 365 Client Credentials integration in SaaS Management by completing all the steps in the Integrating Beta Microsoft 365 Custom Client Credentials With SaaS Management section.

12.

Proceed to Integrating Beta Microsoft 365 Custom Client Credentials With SaaS Management.

Integrating Beta Microsoft 365 Custom Client Credentials With SaaS Management

Complete the following steps to integrate Microsoft 365 Custom Client Credentials with SaaS Management.

To integrate Beta Microsoft 365 Custom Client Credentials with SaaS Management:

Complete the prerequisite steps in Obtaining Client Credentials, Directory (Tenant) ID, Microsoft Graph URL, and Access Token URL for Beta Microsoft 365 Custom Client Credentials.

Add the Beta Microsoft 365 Custom Client Credentials application in SaaS Management. For more information, see Adding an Application.

In the Add Application page for Beta Microsoft 365 Custom Client Credentials:

Select the Application Roster and Application Access integration task checkboxes.

Copy and paste the Application (Client) ID, Client Secrets Value, and Directory (Tenant) ID values from Obtaining Client Credentials, Directory (Tenant) ID, Microsoft Graph URL, and Access Token URL for Beta Microsoft 365 Custom Client Credentials into the respective SaaS Management fields.

Enter the Access Token URL and Microsoft Graph URL into the respective SaaS Management fields.

Click Authorize.

After you have successfully integrated Microsoft 365 with SaaS Management, the following Microsoft information is available in the Users tab.

Users Tab Column

Description

UPN

This User Principal Name (UPN) column is a user filtering option.

Licenses

This column filters discovered and assigned Microsoft licenses.

Activations

This column lists the names of the on-premises products the user has activated.

Mail Usage

This column displays the user’s mailbox storage consumption in MB.

OneDrive Usage

This column displays the user’s OneDrive for Business (OD4B) storage consumption in MB.

Windows

Is the user using a Windows desktop machine? (Yes or No is displayed.)

Mac

Is the user using a Mac device? (Yes or No is displayed.)

Mobile

Is the user using a mobile device? (Yes or No is displayed.)

Web

Has the user accessed Microsoft 365 applications via a browser? (Yes or No is displayed.)

onPremisesSync

The following deployment options are displayed:

•

Yes, if it is an on-premises sync

•

No, if it is a cloud sync.

Block Credentials

Are the user’s Microsoft 365 credentials blocked? (Yes or No is displayed.)

Users with blocked credentials cannot access their Microsoft 365 account, which limits their account activity. Limited account activity due to blocked credentials may inaccurately reflect license downgrading or license reclamation opportunities.

Is MFA Turned On

Has the user turned on multifactor authentication (MFA) for their Microsoft 365 account? (Yes or No is displayed.)

Users signing in to their Microsoft 365 account with multifactor authentication or single sign-on (SSO) should not have their licenses reclaimed.

Last Used M365 Application

Displays the Microsoft 365 application that was last used by the user. This application is based on the user activities retrieved by the Microsoft 365 integration with SaaS Management.

If users are not using a more expensive application within a Microsoft 365 license, there may be opportunities to downgrade user licenses.

Displays a timestamp for the last time users signed in to their Microsoft 365 account.

Infrequent user sign ins may provide license downgrading or license reclamation opportunities.

Note:It is possible that the date in the Sign In to M365 Domain column may differ from the date in the Last Activity column. The Last Activity date refers to the last time users accessed a specific Microsoft 365 product such as Teams or Outlook. It is also possible for users to have a Sign In to M365 Domain value while never having used a Microsoft 365 application. These users would appear as Never under Last Activity.

Days Since Last Activity

This is the number of days since the user’s last activity.

Guest

Is the user a Guest (that is, not a permanent employee such as a contractor)? (Yes or No is displayed.)

Title

The job title of the user is provided by Active Directory.

Country

This is the geographical location of the user.

Account Created Date

This is the date the user’s Microsoft 365 account was created within the Microsoft portal.

Note:Consider the following:

•

Some fields may not be available due to cloud deployment limitations.

•

Application Roster data such as Mail Usage, OneDrive Usage, Activations, Windows, Mac, Mobile, and Web is available 3 days after the event(s) occurs. Therefore, the data in the Microsoft Portal may not match the data in SaaS Management for these Users tab columns, which are part of the Application Roster.

•

Flexera captures only the last 90 days of data for the following Users tab columns: Activations, Mail Usage, OneDrive Usage, Windows, Mac, Mobile, and Web.

•

Due to the current behavior of the Microsoft report API, if users have not activated any applications (Microsoft 365 apps for enterprise, Microsoft Project Online desktop client, Microsoft Visio desktop app, and Office Mobile apps for Office 365) 90 days from the date of the integration setup: the Activations column will be blank and display a "-" and for any new activations on day 91, the count will reflect on the Microsoft report API 3 days after the activation and will be retained in the report for the next 90 days.

•

Flexera obtains Activations data only when we activate the following Office 365 subscriptions such as Microsoft 365 apps for enterprise, Microsoft Project Online desktop client, Microsoft Visio desktop app, and Office Mobile apps for Office 365 across Windows and Mac machines (For more information, see Microsoft’s documentation topic, Microsoft 365 Reports in the Admin Center - Microsoft Office Activations).

•

Flexera obtains Yes values for the Windows, Mac, Mobile, and Web columns only when users perform activities in the following applications: Outlook, Word, Excel, PowerPoint, OneNote, and Teams (For more information, see Microsoft’s documentation topic, Microsoft 365 Reports in the Admin Center - Microsoft 365 Apps Usage).

For further information on managing and optimizing your organization’s Beta Microsoft 365 Custom Client Credentials licenses, see:

•

Auto-Populated License Information for Beta Microsoft 365 Custom Client Credentials

•

Managing Available Licenses for Beta Microsoft 365 Custom Client Credentials

•

Tracking Application Activity by License Type for License Differentiation.

Auto-Populated License Information for Beta Microsoft 365 Custom Client Credentials

The SaaS Management integration with Beta Microsoft 365 Custom Client Credentials offers a License Information integration task that automatically retrieves every 24 hours the name of the Microsoft 365 plan, license type, and total allowed number of licenses. This auto-populated Microsoft 365 license information provides a more complete view of your Microsoft SaaS entitlements and component usage by displaying:

•

Assigned entitlements.

•

User’s license activity (based on the user’s last login)

•

An 11 Services filter in the Microsoft 365 Activity tab, which helps you narrow the focus of your organization’s Microsoft 365 license activity.

Important:If you enable the License Information integration task, you need to enter and keep up to date the following Licenses Tab information. The License Information integration task does not pull in this information. The SaaS application’s annual spend calculation relies on entered and accurate license effective and expiration dates.

•

Effective Date

•

Expiration Date

•

Cost

•

Currency

•

Payment Frequency

To auto-populate Microsoft 365 license information, see Auto-Populating SaaS Application License Information. When the License Information integration task is enabled, the License type, Name, and Provisioned fields in the Microsoft 365 Licenses tab are disabled as this information is automatically populated. The active and inactive ingested license data from Microsoft can be compared against the Subscriptions data from the Licenses menu of the Microsoft 365 Admin Center.

Managing Available Licenses for Beta Microsoft 365 Custom Client Credentials

After the License Information integration task for Auto-Populated License Information for Beta Microsoft 365 Custom Client Credentials is enabled, you can add or remove the Microsoft 365 product licenses you wish to manage within SaaS Management. To manage available Microsoft 365 licenses, see Managing Available SaaS Application Licenses.

Note:Unselected licenses are not shown in SaaS Management and are filtered out from all calculations.

API Endpoints for Beta Microsoft 365 Custom Client Credentials

Application Roster

https://<<Microsoft Graph URL>>/v1.0/users

https://<<Microsoft Graph URL>>/v1.0/subscribedSkus

https://<<Microsoft Graph URL>>/beta/reports/getOffice365ActivationsUserDetail

https://<<Microsoft Graph URL>>/beta/reports/getM365AppUserDetail

https://<<Microsoft Graph URL>>/beta/reports/getOneDriveUsageAccountDetail

https://<<Microsoft Graph URL>>/beta/reports/getMailboxUsageDetail

https://<<Microsoft Graph URL>>/beta/reports/authenticationMethods/userRegistrationDetails

Application Access

https://<<Microsoft Graph URL>>/v1.0/users

https://<<Microsoft Graph URL>>/beta/reports/getOffice365ActiveUserDetail

https://<<Microsoft Graph URL>>/beta/reports/getEmailActivityUserDetail

https://<<Microsoft Graph URL>>/beta/auditLogs/signIns

License Information

https://<<Microsoft Graph URL>>/v1.0/subscribedSkus