Skip to main content

Microsoft Exchange Online

info

Note: In Console version 25.03, “Microsoft 365” was renamed to “Exchange Online”.

This connector integrates Cyberhaven with Exchange Online to gain insight into email activity that includes attachments. It uses a Microsoft Entra Enterprise application to read events and user information from your tenant.

Before you begin, review prerequisites: Echange Online Overview

Connect Cyberhaven to Exchange Online​

  1. In the Cyberhaven Console, click the cloud icon in the left navigation (bottom‑left).
  2. Click Connect next to Exchange Online.
  3. In the pop‑up window, authenticate with an account that has Global Administrator rights in Entra ID. Click Next.
    • A Global Administrator is only needed to approve the Cyberhaven app for the integration. No standing service account with global admin privileges is required.
  4. Grant permissions to the Cyberhaven‑O365‑connector application for your tenant. See the prerequisites page for the full list of required permissions.
  5. After successful authorization, you will receive a confirmation that installation was successful.

Once the newly connected Exchange Online tenant appears on the Cloud Sensors page, you can select it to view its details.

After connection, Cyberhaven begins retrieving Exchange Online events for the previous 72 hours. It can take up to one hour for events to appear in the Console.

Troubleshooting​

  • URL mismatch error: If you see “The reply URL specified does not match the reply URLs configured for the application,” create a support ticket in the Cyberhaven support portal to request that the connector be enabled on the backend.
  • Permissions error: If you see a permissions prompt or failure, the signed‑in user does not have the required Global Administrator rights. Sign in again with a Global Administrator to complete installation.

Disconnect and remove​

  • To disconnect the Exchange Online connector, click DISCONNECT in the connector details on the Cloud Sensors page.
  • To remove the app from Microsoft Entra (Azure):
    1. Sign in to your Azure tenant with administrator rights.
    2. Open Enterprise applications and search for Cyberhaven‑O365‑connector.
    3. Select the application, then go to Manage > Properties.
    4. Click Delete and confirm. If deletion fails, verify you are signed in with sufficient privileges.