Integration Guide: Microsoft 365

Overview

The Microsoft 365 integration connects Tello IAM to your organization's Microsoft 365 environment, allowing Tello to monitor and manage license access for users across your Microsoft 365 tenant.

Required prerequisite: Microsoft Entra ID must be connected to Tello IAM before Microsoft 365 can be added. Microsoft 365 reuses the shared Microsoft identity context established by the Entra ID connection. If Entra ID is not yet connected, see Microsoft Entra ID before proceeding.

Before connecting

Before adding the Microsoft 365 integration, confirm the following:

• Microsoft Entra ID is connected and active in Tello IAM
• The Entra ID connection uses the same tenant as the Microsoft 365 environment being connected
• The Administrator completing the connection has a Global Administrator account in the Microsoft 365 tenant

Connect Microsoft 365

1. Navigate to Integrations in the left navigation.
2. Select + Add Integration.
3. Search for Microsoft 365 and select Add.
4. In the Microsoft 365 Tenant Domain field, enter your organization's Microsoft domain (for example, contoso.onmicrosoft.com or contoso.com).
5. In the Entra ID Instance field, select the active Entra ID connection for this tenant. If no active Entra ID connection is available, the field will display a warning — connect Entra ID first before proceeding.
6. Optionally, enter a two-letter country or region code in the Default Usage Location field (for example, US). This value is applied to Entra users before Microsoft 365 licenses are assigned.
7. Select Login to Microsoft 365. You will be redirected to Microsoft to authorize access.
8. Select the Global Administrator account to use for authorization, or select Use another account to sign in with a different account.
9. On the Permissions requested screen, review the permissions Tello IAM is requesting. Ensure Consent on behalf of your organization is checked, then select Accept.
10. After authorization is complete, Tello IAM displays a Connection Established confirmation showing the organization name and connection timestamp. Select Done. The integration appears on the Integrations page and an initial sync begins automatically.

Permissions granted

During the authorization flow, Tello IAM requests the following permissions in Microsoft 365:

• Read all users' full profiles — allows Tello IAM to import user data from the tenant
• Manage all license assignments — allows Tello IAM to provision and deprovision Microsoft 365 licenses
• Read organization information — allows Tello IAM to identify the tenant and organizational structure
• Maintain access to data you have given it access to — allows Tello IAM to retain access for ongoing sync operations

These permissions are granted on behalf of the organization by a Global Administrator. No individual users will be prompted to review or accept permissions.

Verify the connection

After the initial sync completes, confirm the following on the Integrations page:

• The Microsoft 365 integration displays a status of Active
• A sync timestamp is present and reflects the completed sync
• User records on the Users page display detected Microsoft 365 permissions in the Access column

If the integration does not show as Active, select Sync Now to trigger a manual sync. If the issue persists, confirm the Entra ID connection is active and that the authorizing account retains Global Administrator privileges.

Reauthorizing the connection

If the Microsoft 365 integration loses authorization — for example, if the authorizing account's permissions are changed or the account is removed — the integration will display an error on the Integrations page. To reauthorize, select the integration row, select Configure, and complete the authorization flow again using a valid Global Administrator account.

Related articles

• Microsoft Entra ID — required prerequisite for this integration
• Configuring Integrations — manage sync schedules, drift detection, and integration settings
• Understanding Errors — resolve integration errors and authorization failures