How do I collect from Microsoft 365?

The Nanitor Collector evaluates your Microsoft 365 tenant against the CIS Microsoft 365 Foundations benchmark. It reads your tenant's configuration through the Microsoft Graph API using an app registration you create in Microsoft Entra ID. Access is read-only — Nanitor never changes anything in your tenant.

Prerequisites

• A Windows collector host. The Microsoft Graph PowerShell cmdlets do not run on Linux. Microsoft 365 collection requires a Windows host.
• Windows PowerShell 5.1 (built into Windows). The collector runs the checks with powershell.exe. PowerShell 7 may also be installed, but the Graph modules must be installed for Windows PowerShell — see Step 1.
• Execution policy RemoteSigned or less restrictive, so the Graph modules can load. Check with Get-ExecutionPolicy -Scope LocalMachine; set if needed with Set-ExecutionPolicy RemoteSigned -Scope LocalMachine.
• Outbound HTTPS from the collector host to login.microsoftonline.com and graph.microsoft.com.
• An account with Global Administrator or Privileged Role Administrator in the tenant, to grant admin consent.

Step 1 — Install Required PowerShell Modules

Open Windows PowerShell (not PowerShell 7 / pwsh) as Administrator on the collector host and run:

Install-Module Microsoft.Graph -Scope AllUsers -Force -AllowClobber
Install-Module Microsoft.Graph.Beta -Scope AllUsers -Force -AllowClobber

Save-Module Microsoft.Graph -Path C:\ModuleCache -Force
Save-Module Microsoft.Graph.Beta -Path C:\ModuleCache -Force

Verify, in Windows PowerShell:

Get-Module Microsoft.Graph -ListAvailable
Get-Module Microsoft.Graph.Beta -ListAvailable
Get-Module Microsoft.Graph.Authentication -ListAvailable

All three should return version information. If any returns nothing, the installation did not succeed for Windows PowerShell.

Step 2 — Register an application in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center as a Global Administrator or Application Administrator.
2. Go to Identity → Applications → App registrations → New registration.
3. Enter a name (for example Nanitor Collector).
4. Under Supported account types, select Accounts in this organizational directory only (Single tenant).
5. Leave Redirect URI blank. Click Register.
6. On the Overview page, note the Application (client) ID and Directory (tenant) ID.

Step 3 — Grant API permissions

In the app registration go to API permissions → Add a permission → Microsoft Graph → Application permissions (not Delegated) and add every permission below. Then click Grant admin consent for [your organization] and confirm every row shows a green check under Status.

All permissions are read-only. Permissions without admin consent cause the controls that need them to report Error.

Step 4 — Create a client secret

1. In the app registration, go to Certificates & secrets → Client secrets → New client secret.
2. Enter a description and choose an expiry (maximum 24 months).
3. Click Add and copy the Value immediately — it is shown only once.

Step 5 — Add the credential in Nanitor

In Nanitor, go to Organization Management → Collectors → Credentials and add a credential.

Select Azure as the Access method and fill in:

• Client ID — the Application (client) ID from Step 2
• Tenant ID — the Directory (tenant) ID from Step 2
• Client Secret — the value copied in Step 4

Step 6 — Start data collection

Go to the Asset tab and select Add asset.

In the dialog:

• Set Asset type to Cloud
• Select your Collector
• Give the environment an identifiable Name
• Set Cloud type to Microsoft
• Select the Credential created in Step 5
• Set a Label to define priority (can be done later)

The collector authenticates and runs the first collection. Results appear within a few minutes and are refreshed once every 24 hours.

If no results appear, confirm the Microsoft 365 Foundations benchmark is enabled under Administration → Organization Management → Benchmarks.

Verification

1. In Entra ID, open Enterprise applications → [your app] → Permissions and confirm every permission from Step 3 is listed as granted by an admin.
2. On the collector host, in Windows PowerShell, confirm Get-Module Microsoft.Graph -ListAvailable returns a version.
3. Trigger a manual check-in and read the collector log. A healthy run shows Started getting Cloud ScapInfo / Ended getting Cloud ScapInfo with no Error running: lines between them.
4. Confirm benchmark results appear on the asset in Nanitor.

Troubleshooting

Find the message from your collector log in the left column.

Permission changes take effect on the next collection — the collector requests a new access token every time it runs. Allow a few minutes after granting consent for Microsoft to apply the change.

Remediation for existing customers

If you configured M365 collection before August 2025 (Nanitor v6.4.0), you are likely affected by missing PowerShell modules, insufficient permissions, or both.

Missing PowerShell modules

Symptom: Collector logs show CommandNotFoundException: The term 'Connect-MgGraph' is not recognized. A successful checkin confirmation alone does not mean Graph data was collected. Always verify that benchmark results appear in the Nanitor UI after setup.

Fix: On the collector host, in Windows PowerShell run as Administrator:

Install-Module Microsoft.Graph -Scope AllUsers -Force -AllowClobber
Install-Module Microsoft.Graph.Beta -Scope AllUsers -Force -AllowClobber

Insufficient API permissions

Symptom: Modules are installed but benchmark controls return empty results, return 403 Forbidden errors, or consistently fail.

Fix: Setups made before August 2025 usually have only SecurityEvents.Read.All — keep it, it is still required. Compare the permissions on your existing app registration against the full list in Step 3. Two scopes commonly missing from older setups are OrgSettings-AppsAndServices.Read.All and OrgSettings-Forms.Read.All. Add any missing permissions and click Grant admin consent. You do not need to create a new app registration.