--- title: Microsoft 365 Integration description: Connect your Microsoft 365 tenant so DIBFI can read configuration signals from Entra and Intune, turn them into CMMC findings, and pre-fill implementation status and statements on your assessment. navigation: icon: i-lucide-plug --- # Microsoft 365 Integration The **Microsoft 365 Integration** connects your Microsoft 365 tenant to DIBFI so the platform can read specific **configuration signals** — from **Entra ID** (identity) and **Intune** (devices) — and map them to the CMMC controls they help satisfy. DIBFI runs a **scan**, turns what it reads into **findings**, and lets you import those findings to **pre-fill implementation status and statements** on an assessment. The integration is **read-only**. You authorize DIBFI to *read* a defined set of security settings; DIBFI **never changes, creates, or deletes anything** in your Microsoft tenant. Its purpose is to save you from manually documenting controls that your tenant already enforces — evidence you'd otherwise gather by hand. ::note Find it in the sidebar under **Organization Settings → Integrations** (`/dashboard/org-settings`). Connecting, scanning, and importing require an integrations-manager role — see [Permissions](#permissions). :: --- ## Key concepts ### What a connection is A **connection** links one Microsoft 365 tenant to your organization in DIBFI. You choose which cloud environment your tenant lives in when you connect. | Environment | For | | --- | --- | | :badge[Commercial]{color="info"} | Standard Microsoft 365 commercial tenants | | :badge[GCC High]{color="warning"} | Microsoft 365 Government (GCC High) tenants | ::tip Pick the environment that matches where your CUI actually lives. Defense contractors handling CUI are typically on **GCC High**; choosing the wrong cloud means the sign-in will fail because the tenant isn't there. :: ### What a scan reads A **scan** inspects a fixed set of configuration areas and produces a finding for each control it can speak to. DIBFI only ever reads these areas — it does not browse your data, mail, or files. | Area | What it looks at | | --- | --- | | **Conditional Access** | Access policies that gate sign-in | | **MFA / Auth Methods** | Multi-factor and authentication method configuration | | **Directory RBAC** | Administrative role assignments | | **Break-Glass Accounts** | Emergency-access account hygiene | | **Device Compliance** | Intune device-compliance posture | | **Device Configuration** | Intune device-configuration settings | | **Audit Logging** | Whether auditing is enabled and retained | | **Sign-In Logs** | Sign-in activity signals | | **Secure Score** | Microsoft's tenant security score | ### What a finding is Each **finding** ties one configuration signal to the CMMC objective it informs. A finding carries a **suggested status**, a ready-to-use **implementation statement**, and a plain-language **summary** of what was observed. | Suggested status | Meaning | | --- | --- | | :badge[Implemented]{color="success"} | The setting fully satisfies the objective | | :badge[Partially implemented]{color="warning"} | The setting partly satisfies the objective | | :badge[Not implemented]{color="error"} | The setting does not satisfy the objective | ::note A finding is a **suggestion**, not an automatic verdict. Nothing changes on your assessment until you review the findings and choose to **import** them. :: --- ## Using the integration ### Connect your tenant ::steps{level="4"} #### Start the connection From **Organization Settings → Integrations**, choose to connect Microsoft 365 and select your **environment** (Commercial or GCC High). #### Sign in with Microsoft You're taken to Microsoft's own secure sign-in. Sign in as an administrator of the tenant and **review the read-only permissions** DIBFI requests, then consent. #### Confirm the connection Microsoft returns you to DIBFI, which records the connection — showing your tenant name and the account that authorized it. You're now ready to scan. :: ::tip The consent screen is where you can see exactly what DIBFI is asking for. Every permission is a **read** permission on configuration signals — there is no write or delete access in the request. :: ### Run a scan ::steps{level="4"} #### Start the scan From the connection, run a scan. DIBFI reads each configuration area and works through them in one pass. #### Review the results When the scan completes, you get a list of **findings** — one per objective it could assess — each with a suggested status, a summary of what was observed, and a drafted implementation statement. :: ::note You can re-scan at any time to refresh the picture as your tenant changes. If a scan can't reach your tenant — for example, access was revoked on the Microsoft side — the connection is flagged so you can reconnect. :: ### Import findings to an assessment Importing is how findings become part of your compliance record. You choose which findings to bring in, and which assessment they land on. ::steps{level="4"} #### Select findings and an assessment Pick the findings you trust and the **assessment** they should apply to. #### Choose how to handle existing answers Decide whether to **overwrite** objectives you've already answered, or to **only fill in blanks** — leaving any status you've already set untouched. #### Import DIBFI maps each finding to its CMMC objective and writes the suggested **implementation status** and **statement** onto the assessment, ready for you to review and refine. :: ::warning Imported statuses and statements are a **starting point** you own, not a final answer. Review each imported objective, confirm it reflects your environment, and attach supporting evidence — an assessor tests your claims, not the tool's suggestions. :: --- ## Permissions Managing the integration is governed by a single permission in the role matrix. | Capability | Permission | | --- | --- | | Connect / disconnect a tenant, run scans, import findings | :badge[MANAGE_INTEGRATIONS]{color="info"} | `MANAGE_INTEGRATIONS` is held by roles that administer your organization's integrations — typically **Org Admin** (and the equivalent MSP admin roles). Roles without it can't connect, scan, or import. ::warning Connecting a tenant grants DIBFI read access to your Microsoft 365 configuration, so it's deliberately limited to integration managers. Anyone can benefit from the results once findings are imported to an assessment, but only a manager can create or remove the connection. :: --- ## How it works Extra detail on how the integration behaves — product behavior, not internals. ### Read-only, always DIBFI requests **read-only** access to a defined set of configuration signals in Entra and Intune. It **never** modifies your tenant, and it does not read your users' mail, files, or content — only the security and device configuration needed to assess the mapped controls. You can review the exact scope on Microsoft's consent screen before you approve it. ### How findings map to your assessment Every finding is tied to the CMMC practice it informs. On import, DIBFI matches the finding to the corresponding **objective** on your chosen assessment and applies: - a **status** — Implemented, Partially implemented, or Not implemented, translated to the assessment's met / partially met / not met scale, and - an **implementation statement** — drafted from what the scan observed, so the objective's write-up starts filled in rather than blank. Your **overwrite** choice controls the rest: with overwrite on, imported findings replace what's there; with it off, DIBFI only writes objectives you haven't answered yet, so your existing work is preserved. ### Disconnecting Removing a connection is immediate and complete: DIBFI drops the stored authorization for that tenant and stops all future scans. **Findings you already imported stay on your assessment** — they've become your own compliance record. If you reconnect later, you sign in with Microsoft again to establish a fresh authorization. ::note Because the authorization lives with the connection, disconnecting is the clean way to cut DIBFI's access from the DIBFI side. You can also revoke DIBFI's consent from within your Microsoft tenant's admin center at any time. :: --- ## Related features :::card-group ::card{title="Assessments" icon="i-lucide-clipboard-check" to="https://app.dibfi.com/dashboard/systems"} Where imported findings pre-fill objective status and implementation statements. :: ::card{title="Evidence" icon="i-lucide-paperclip"} Attach supporting evidence to the objectives your scan helped answer. :: ::card{title="AI Connector" icon="i-lucide-bot" to="https://app.dibfi.com/dashboard/org-settings"} Give an AI assistant read-only access to the posture your integrations feed. :: :::