Office 365 Client Credentials

Best Practice:Office 365 Client Credentials is no longer available when selecting Add Application on the Managed SaaS Applications page. Use instead the Microsoft 365, Microsoft 365 Certificate Based Authentication, or Microsoft 365 Client Credentials integration to view your organization’s Office 365 Client Credentials, Dynamics 365 Client Credentials, Power BI Client Credentials, Project Client Credentials, and Visio Client Credentials license usage data. To deactivate an existing integration, see Avoiding Duplicate Microsoft 365 Client Credentials Licenses between SaaS Management and IT Asset Management.

Office 365 is a cloud-based service that is designed to help meet your organization's needs for robust security, reliability, and user productivity.

Important:This Office 365 Client Credentials integration requires the authentication method OAuth2 with client credentials.

The following sections explain prerequisites, resources, and instructions for integrating with SaaS Management.

•

Stored Information for Office 365 Client Credentials

•

Required Minimum Permissions for Office 365 Client Credentials

•

Authentication Method for Office 365 Client Credentials

•

Required Credentials for Office 365 Client Credentials

•

License Types for Office 365 Client Credentials

•

Obtaining Client Credentials and Tenant ID for Office 365 Client Credentials

•

Data Anonymization for Office 365 Client Credentials

•

Integrating Office 365 Client Credentials With SaaS Management

•

Auto-Populated License Information for Office 365 Client Credentials

•

API Endpoints for Office 365 Client Credentials

Stored Information for Office 365 Client Credentials

The following table describes the available integration tasks and stored data within [ProductName].

Available Integration Tasks

Information Stored

Application Roster

•

User ID (User Principal Name)

•

First Name

•

Last Name

•

Active Date

•

Deactivated Date

•

Assigned Licenses

Application Access

Last Activity Date of the following applications:

•

Microsoft Exchange Server

•

Microsoft Teams

•

OneDrive

•

Outlook

•

SharePoint

•

Skype for Business

•

Yammer

Note:Application Access data is available 3 days after the event(s) occurs. Therefore, the data in the Microsoft Portal may not match the data in SaaS Management for application access.

License Differentiation

See License Types for Office 365 Client Credentials and Tracking Application Activity by License Type for License Differentiation.

License Information

•

License Name

•

License Type

•

Purchased Quantity

Note:The SaaS Management License Information integration task retrieves information once every 24 hours. Therefore, the data in the Microsoft Portal may not match the data in SaaS Management.

Reclamation

Reclaiming SaaS licenses affects all of the user’s licenses within a SaaS integration. For example, a user has licenses for Office 365 Exchange, Outlook, and Yammer. However, the Software Asset Manager is only managing licenses for Office 365 Exchange and Outlook. Reclamation removes all three (Office 365 Exchange, Outlook, and Yammer) licenses from the user.

To reclaim Office 365 Client Credential licenses, see Reclaiming SaaS Licenses.

Note:The information stored is subject to change as enhancements are made to the SaaS application.

Required Minimum Permissions for Office 365 Client Credentials

The minimum API required permissions are based on the Required Application Permissions for Office 365 Client Credentials and the Required User Role for Office 365 Client Credentials.

Required Application Permissions for Office 365 Client Credentials

Application Permission	Description	Integration Task Name
Directory.Read.All	Enables you to read the list of users in your Microsoft account.	Application Roster License Information
Reports.Read.All	Enables you to read the user access event details in your Microsoft account.	Application Access
User.ReadWrite.All	Is required to modify the license assigned to the user.	Reclamation

Required User Role for Office 365 Client Credentials

Note:The following SaaS application user role is not applicable to Flexera One roles.

User Role	Description
Global Administrator	To grant the application permissions, the user must have Global Administrator access. For more information, see Microsoft’s documentation topic, Microsoft Entra Built-In Roles.

Authentication Method for Office 365 Client Credentials

The required authentication method is OAuth 2.0 With Client Credentials. For more information, see Microsoft’s documentation topic, Microsoft Identity Platform and the OAuth 2.0 Client Credentials Flow.

Required Credentials for Office 365 Client Credentials

The following credentials are required:

•

Client ID

•

Client Secret

•

Tenant ID.

License Types for Office 365 Client Credentials

To learn more about the product names and service plan identifiers for Office 365 licenses, see Microsoft’s documentation topic, Product Names and Service Plan Identifiers for Licensing.

Obtaining Client Credentials and Tenant ID for Office 365 Client Credentials

To obtain client credentials and tenant ID, perform the following steps.

To obtain Client Credentials and Tenant ID:

In the Search box at the top of the page, enter App registrations and click App registrations in the search results to select it. The App registrations page opens.

Click New Registration. The Register an application page opens.

Enter a Name and choose the Accounts in this organizational directory only option.

Click Register.

On the Overview tab, copy the Application (client) ID and copy the Directory (tenant) ID to a location you can access later. You will need these values in Integrating Office 365 Client Credentials With SaaS Management.

To generate a Client secret, do the following:

Click the Certificates & secrets tab.

Under Client secrets, click New client secret. The Add a client secret dialog box opens.

In the Description field, enter a name for the new secret.

Under Expires, choose an expiration value.

Click Add.

Under Client secrets, copy the client secret value. You will need this in Integrating Office 365 Client Credentials With SaaS Management.

Click the API permissions tab and complete the following:

Click Microsoft Graph. The Request API permissions panel opens.

Click Application permissions.

Note:Do not select Delegated permissions. Delegated permissions will not work.

In the Select permissions search box, enter Directory and then click the arrow to expand Directory, and select the Directory.Read.All permission checkbox.

In the Select permissions search box, enter Reports and then click the arrow to expand Reports, and select the Reports.Read.All permission checkbox.

Click Update permissions.

After the permissions are added, grant admin consent.

10.

Complete Integrating Office 365 Client Credentials With SaaS Management.

Data Anonymization for Office 365 Client Credentials

Data anonymization is the processing technique that removes or modifies identifiable information. After the process is complete, data cannot be associated with a specific user. It helps protect private and sensitive data as well as private activities while maintaining its integrity.

When adding the Office 365 Client Credentials application, it is important to make sure that anonymized users are not imported from Office 365 Client Credentials into SaaS Management. You will need to access reports that provide information about your organization’s use of applications and services.

The following procedure is important as a prerequisite to ensure that anonymized user data is not imported when integrating Office 365 Client Credentials with SaaS Management.

To view reports with anonymized user data:

In the menu, go to Settings > Org settings and click the Services link at the top.

Scroll down and click Reports.

In the window that is displayed, clear the Display concealed user, group, and site names in all reports box.

Proceed to Integrating Office 365 Client Credentials With SaaS Management.

Note:Ensure that data anonymization is disabled in your Microsoft account. Otherwise, all activity data will end up in Suspicious SaaS Activities. For more information, see Microsoft’s documentation topic, Microsoft 365 Reports Show Anonymous User Names Instead of Actual User Names. If anonymized user data has been imported after integrating Office 365 with SaaS Management, submit a Flexera Support Case.

Integrating Office 365 Client Credentials With SaaS Management

To integrate Office 365 Client Credentials with SaaS Management, perform the following steps.

To integrate Office 365 Client Credentials with SaaS Management:

In the Microsoft Azure Portal, enter your Global Administrator username and password to sign in.

From your Microsoft account, copy the Client ID, Client Secret, and Tenant ID values.

In SaaS Management, add the Office 365 Client Credentials application. For more information, see Adding an Application.

In the Add Application page for Office 365 Credentials:

Select the Application Roster and Application Access integration tasks checkboxes.

Paste the values copied into the Client ID, Client Secret, and Tenant ID fields.

Click Authorize.

Note:All blocked users will be displayed as normal users in SaaS Management.

For further information on managing and optimizing your organization’s Office 365 Client Credentials licenses, see:

•

Auto-Populated License Information for Office 365 Client Credentials

•

Tracking Application Activity by License Type for License Differentiation

•

Reclaiming SaaS Licenses.

Auto-Populated License Information for Office 365 Client Credentials

The SaaS Management integration with Office 365 Client Credentials offers a License Information integration task that automatically retrieves every 24 hours the name of the Office 365 plan, license type, and total allowed number of licenses. This auto-populated Office 365 Client Credentials license information provides a more complete view of your Microsoft SaaS entitlements and component usage by displaying:

•

Assigned entitlements.

•

User’s license activity (based on the user’s last login) for O365 Exchange, O365 OneDrive, O365 SharePoint, O365 Skype, O365 Yammer, O365 Teams, and O365 Outlook.

•

A 7 Services filter in the Office 365 Activity tab, which helps you narrow the focus of your organization’s Office 365 license activity.

Important:If you enable the License Information integration task, you need to enter and keep up to date the following Licenses Tab information. The License Information integration task does not pull in this information. The SaaS application’s annual spend calculation relies on entered and accurate license effective and ending dates.

•

Amount

•

Currency

•

Effective Date

•

Ending Date

•

Payment Frequency

To auto-populate Office 365 Client Credentials license information, see Auto-Populating SaaS Application License Information. When the License Information integration task is enabled, the License type, Name, and # of Items Allowed fields in the Office 365 Client Credentials Licenses tab are disabled as this information is automatically populated. The active and inactive ingested license data from Microsoft can be compared against the Subscriptions data from the Licenses menu of the Microsoft 365 Admin Center.

API Endpoints for Office 365 Client Credentials

Application Roster

https://graph.microsoft.com/v1.0/users

https://graph.microsoft.com/v1.0/subscribedSkus

Application Access

https://graph.microsoft.com/beta/reports/getOffice365ActiveUserDetail

https://graph.microsoft.com/beta/reports/getEmailActivityUserDetail

License Information:

https://graph.microsoft.com/v1.0/subscribedSkus

Reclamation

https://graph.microsoft.com/v1.0/users{id | userPrincipalName}/assignLicense

https://graph.microsoft.com/v1.0/subscribedSkus