The Microsoft 365 connection uses a Microsoft partner tenant to discover customer tenants through active Granular Delegated Admin Privileges (GDAP) relationships. It is separate from Microsoft Entra single sign-on.
Availability is enabled per Lexful account. If Microsoft 365 is not shown under Data sources, contact Lexful support before preparing a connection.
What the connection collects
The configured feeds cover directory users, subscribed licenses, Office 365 activity reports, authentication-method registration, Intune managed devices and Secure Score. Data availability depends on customer consent, Microsoft permissions and the customer’s licenses.
This connection is not a mailbox or SharePoint content import, and connecting it does not automatically provision Lexful users or configure SSO. Collected datasets do not all become documentation records.
Before you connect
Use a Microsoft work account in the partner tenant that manages the intended customers.
Confirm active GDAP relationships for those customer tenants. The current customer-discovery flow includes relationships carrying Application Administrator, Cloud Application Administrator or Global Administrator. An expired or inactive relationship is excluded.
The connecting account must be able to complete the Microsoft consent flow. Reading GDAP relationships uses Microsoft Graph permissions; see Microsoft’s delegated-admin relationship API requirements.
Customer application consent is separate from the partner sign-in and GDAP relationship. Confirm consent and collection access for each intended customer with Lexful support. A successful partner connection alone does not establish access to every customer feed.
Connect the partner tenant
As a Lexful administrator, open Platform → Integrations → Data sources.
Choose Microsoft 365 → Connect and continue to Microsoft sign-in.
Select the partner tenant account, review the requested permissions and complete consent.
Return to Lexful and verify the connection. Confirm that the intended customers have been discovered and their consent is ready before relying on collection results.
You do not enter a tenant password, client secret or API key into Lexful’s generic credentials form for this connection.
If customers or data are missing
No customers: check the selected partner tenant, GDAP relationship status and qualifying roles.
One customer missing: check that customer’s relationship and application consent.
Customer present but a feed fails: review the collection error, customer permissions and Microsoft licensing. Partner discovery does not validate each downstream API.
Contact support with the failing stage and visible error, without tokens or secrets. Support can confirm your account’s rollout and customer-consent setup.