Microsoft 365 Integration
The Microsoft 365 Integration connects your Microsoft 365 tenant to DIBFI so the platform can read specific configuration signals — from Entra ID (identity) and Intune (devices) — and map them to the CMMC controls they help satisfy. DIBFI runs a scan, turns what it reads into findings, and lets you import those findings to pre-fill implementation status and statements on an assessment.
The integration is read-only. You authorize DIBFI to read a defined set of security settings; DIBFI never changes, creates, or deletes anything in your Microsoft tenant. Its purpose is to save you from manually documenting controls that your tenant already enforces — evidence you'd otherwise gather by hand.
/dashboard/org-settings). Connecting, scanning, and importing require an integrations-manager role — see Permissions.Key concepts
What a connection is
A connection links one Microsoft 365 tenant to your organization in DIBFI. You choose which cloud environment your tenant lives in when you connect.
| Environment | For |
|---|---|
| Commercial | Standard Microsoft 365 commercial tenants |
| GCC High | Microsoft 365 Government (GCC High) tenants |
What a scan reads
A scan inspects a fixed set of configuration areas and produces a finding for each control it can speak to. DIBFI only ever reads these areas — it does not browse your data, mail, or files.
| Area | What it looks at |
|---|---|
| Conditional Access | Access policies that gate sign-in |
| MFA / Auth Methods | Multi-factor and authentication method configuration |
| Directory RBAC | Administrative role assignments |
| Break-Glass Accounts | Emergency-access account hygiene |
| Device Compliance | Intune device-compliance posture |
| Device Configuration | Intune device-configuration settings |
| Audit Logging | Whether auditing is enabled and retained |
| Sign-In Logs | Sign-in activity signals |
| Secure Score | Microsoft's tenant security score |
What a finding is
Each finding ties one configuration signal to the CMMC objective it informs. A finding carries a suggested status, a ready-to-use implementation statement, and a plain-language summary of what was observed.
| Suggested status | Meaning |
|---|---|
| Implemented | The setting fully satisfies the objective |
| Partially implemented | The setting partly satisfies the objective |
| Not implemented | The setting does not satisfy the objective |
Using the integration
Connect your tenant
Start the connection
From Organization Settings → Integrations, choose to connect Microsoft 365 and select your environment (Commercial or GCC High).
Sign in with Microsoft
You're taken to Microsoft's own secure sign-in. Sign in as an administrator of the tenant and review the read-only permissions DIBFI requests, then consent.
Confirm the connection
Microsoft returns you to DIBFI, which records the connection — showing your tenant name and the account that authorized it. You're now ready to scan.
Run a scan
Start the scan
From the connection, run a scan. DIBFI reads each configuration area and works through them in one pass.
Review the results
When the scan completes, you get a list of findings — one per objective it could assess — each with a suggested status, a summary of what was observed, and a drafted implementation statement.
Import findings to an assessment
Importing is how findings become part of your compliance record. You choose which findings to bring in, and which assessment they land on.
Select findings and an assessment
Pick the findings you trust and the assessment they should apply to.
Choose how to handle existing answers
Decide whether to overwrite objectives you've already answered, or to only fill in blanks — leaving any status you've already set untouched.
Import
DIBFI maps each finding to its CMMC objective and writes the suggested implementation status and statement onto the assessment, ready for you to review and refine.
Permissions
Managing the integration is governed by a single permission in the role matrix.
| Capability | Permission |
|---|---|
| Connect / disconnect a tenant, run scans, import findings | MANAGE_INTEGRATIONS |
MANAGE_INTEGRATIONS is held by roles that administer your organization's integrations — typically Org Admin (and the equivalent MSP admin roles). Roles without it can't connect, scan, or import.
How it works
Extra detail on how the integration behaves — product behavior, not internals.
Read-only, always
DIBFI requests read-only access to a defined set of configuration signals in Entra and Intune. It never modifies your tenant, and it does not read your users' mail, files, or content — only the security and device configuration needed to assess the mapped controls. You can review the exact scope on Microsoft's consent screen before you approve it.
How findings map to your assessment
Every finding is tied to the CMMC practice it informs. On import, DIBFI matches the finding to the corresponding objective on your chosen assessment and applies:
- a status — Implemented, Partially implemented, or Not implemented, translated to the assessment's met / partially met / not met scale, and
- an implementation statement — drafted from what the scan observed, so the objective's write-up starts filled in rather than blank.
Your overwrite choice controls the rest: with overwrite on, imported findings replace what's there; with it off, DIBFI only writes objectives you haven't answered yet, so your existing work is preserved.
Disconnecting
Removing a connection is immediate and complete: DIBFI drops the stored authorization for that tenant and stops all future scans. Findings you already imported stay on your assessment — they've become your own compliance record. If you reconnect later, you sign in with Microsoft again to establish a fresh authorization.