How do I collect from Microsoft 365?

The Nanitor Microsoft 365 Foundations benchmark collects configuration data from your Microsoft 365 tenant through the Nanitor Collector using the Microsoft Graph API.

Prerequisites

Before starting, confirm the following on your collector host:

• Windows-based collector required. The Microsoft Graph PowerShell cmdlets do not run on Linux. M365 collection requires a Windows host.
• PowerShell 7 or later installed. Earlier versions may have compatibility issues with the Graph modules.
• Execution policy must be RemoteSigned or less restrictive. Check with Get-ExecutionPolicy. Set if needed: Set-ExecutionPolicy RemoteSigned -Scope LocalMachine.
• Global Administrator or Privileged Role Administrator access in the M365 tenant to grant admin consent on API permissions.

Step 1 — Install Required PowerShell Modules

Run the following in an elevated PowerShell session (Run as Administrator) on the collector host:

Install-Module Microsoft.Graph -Scope AllUsers -Force -AllowClobber
Install-Module Microsoft.Graph.Beta -Scope AllUsers -Force -AllowClobber

Verify the installation:

Get-Module Microsoft.Graph -ListAvailable
Get-Module Microsoft.Graph.Beta -ListAvailable

Both should return version information. If either returns nothing, the installation did not succeed.

Step 2 — Register an Application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center as a Global Administrator or Application Administrator.
2. Navigate to Identity → Applications → App registrations → New registration.
3. Enter a name of your choice (e.g. Nanitor Collector).
4. Under Supported account types, select Accounts in this organizational directory only (Single tenant).
5. Leave Redirect URI blank. Click Register.
6. On the Overview page, note the Application (client) ID and Directory (tenant) ID — you will need both when configuring the Nanitor Collector credential.

Step 3 — Grant API Permissions

The Microsoft 365 Foundations benchmark requires the following Application permissions (not Delegated). All permissions require admin consent.

In the app registration, go to API permissions → Add a permission → Microsoft Graph → Application permissions and add each of the following:

After adding all permissions, click Grant admin consent for [your organization]. Every permission must show a green checkmark under the Status column. Permissions without admin consent will cause those benchmark controls to fail silently.

Step 4 — Create a Client Secret

1. In the app registration, go to Certificates & secrets → Client secrets → New client secret.
2. Enter a description and set an expiry (maximum 24 months).
3. Click Add. Copy the Value immediately — it is only shown once.

Step 5 — Configure the Nanitor Collector Credential

In the Nanitor UI, navigate to Organization Management → Collectors → Credentials and add a new credential.

Select Azure as the Access method and fill in:

• Client ID — the Application (client) ID from Step 2
• Tenant ID — the Directory (tenant) ID from Step 2
• Client Secret — the value copied in Step 4

Step 6 — Start Data Collection

Go to the Asset tab and select Add asset.

In the dialog:

• Set Asset type to Cloud
• Select your Collector
• Give the environment an identifiable Name
• Set Cloud type to Microsoft
• Select the Credential created in Step 5
• Set a Label to define priority (can be done later)

The collector will authenticate and run the first collection. Results appear in the Nanitor UI within a few minutes and are refreshed once every 24 hours.

If results do not appear, confirm the Microsoft 365 Foundations benchmark is enabled under Administration → Organization Management → Benchmarks.

Verification

After setup, confirm the following:

1. On the collector host, the Graph module is available:

   Get-Module Microsoft.Graph -ListAvailable
   

2. In Entra ID, go to Enterprise applications → [your app] → Permissions and confirm all required permissions show green checkmarks.
3. Trigger a manual checkin from the collector UI and confirm benchmark results appear in the Nanitor UI.

Remediation for Existing Customers

If you configured M365 collection before August 2025 (Nanitor v6.4.0), you are likely affected by missing PowerShell modules, insufficient permissions, or both.

Missing PowerShell modules

Symptom: Collector logs show CommandNotFoundException: The term 'Connect-MgGraph' is not recognized. The collector may still report "Successfully checked in SCAP info" — this is a known silent-failure behaviour and does not mean collection succeeded.

Fix: On the collector host (elevated PowerShell):

Install-Module Microsoft.Graph -Scope AllUsers -Force -AllowClobber
Install-Module Microsoft.Graph.Beta -Scope AllUsers -Force -AllowClobber

Insufficient API permissions

Symptom: Modules are installed but benchmark controls return empty results or consistently fail.

Fix: Add all permissions listed in Step 3 to your existing app registration and grant admin consent. You do not need to create a new app registration.

Troubleshooting