Overview
This page describes the steps to integrate Microsoft 365 with Josys.
⚠️ If you register a domain configured for account synchronization between on-premises AD (Active Directory) and Microsoft 365 (Entra ID), the integration may not work. (Reference: Official Documentation)
A Microsoft Entra ID P1 or P2 license is required to use the App Usage Status feature. Please also verify the following settings:
- In the Entra admin center, go to [Settings] > [Org settings] > [Services], and then select [Reports].
- Uncheck the "Display concealed user, group, and site names in all reports" option, and save your changes.
Integration Specifications
| Target Plans | Business or Enterprise plans A Microsoft Entra ID P1 or P2 license is required to use the following features: App Usage Status, MFA Status, Last Used Date/Time, Discovered Apps, SSO in Security Settings, MFA Status |
|---|---|
| Administrator Type for Integration |
Global Administrator *Integration is possible with non-Global Administrator permissions, but some information visible on Josys will be restricted. For details, please refer to "Integrating with Josys Using Non-Global Administrator Permissions" on this page. |
| Integration Method | OAuth |
| Integration Key | |
| Supported Actions | Delete Account Discover Accounts Provision Account Discover Licenses Change Licenses Change Role Enforce MFA |
| Account Discovery Statuses | Sign-in Blocked Active Deleted |
| Statuses Excluded from Unmanaged IDs | Deleted |
| Configurable Settings on Provisioning | Plan/License Settings Role Settings |
| Configurable Settings on Deletion | |
| Other Retrieved Fields | ・Licenses ・Created Date/Time ・Last Password Change Date/Time ・Office Location ・On-premises User Principal Name ・User Type ・Groups |
| Visible Fields |
・Licenses ・Role ・Status ・Licenses ・Created Date/Time ・Last Password Change Date/Time ・Office Location ・On-premises ・User ・Principal Name ・User Type ・Groups |
| Retrieved Fields for License Management | App Usage Status Plan Name User Licenses |
| Inactive Criteria | An account is determined as inactive if none of the following activities have occurred within the past 30 days: Email sent from the account / Exchange last activity / OneDrive last activity / SharePoint last activity / Skype for Business last activity / Yammer last activity / Teams last activity |
| Common Fields | License Role Status User |
| Role Editing | Supported |
⚠️ Important Notes on Retrieved Fields
Due to Microsoft specifications, a Microsoft Entra ID P1 or P2 (formerly Azure AD Premium P1/P2) or higher license is required to retrieve certain data. If the license is insufficient, Josys will display "No data available."
Without a Microsoft Entra ID P1 or P2 license, the following fields cannot be retrieved:
- App Usage Status
- MFA Status
Integration Method
- In the left sidebar of Josys, click "Integrations > App Catalog".
- Search for Microsoft 365 and click on it.
- The setup page will appear on the right side.
- Click "Next" and log in with your Global Administrator account.
Integrating with Josys Using Non-Global Administrator Permissions
Please note that while integration with Josys is still possible under the following roles, some features will not be available. If you integrate using a role other than Global Administrator, prior approval is required.
| Role | Retrieve User List | Create User | Delete/Suspend User | Check Usage Status | Check License Info | App Discovery |
|---|---|---|---|---|---|---|
| User | ✓ |
✗ |
✗ |
✗ |
✓ |
✗ |
| User Administrator | ✓ |
✓ |
✓ |
✗ |
✓ |
✗ |
| Reports Reader | ✓ |
✗ |
✗ |
✓ |
✓ |
✓ |
| Global Administrator | ✓ |
✓ |
✓ |
✓ |
✓ |
✓ |
1. Configuration by the Global Administrator
If integrating with non-Global Administrator permissions, prior approval within the Azure Portal is required.
- Log in to the Microsoft Entra admin center.
- Click Entra ID > Enterprise applications > Consent and permissions.
- Click "Admin consent settings" and set "Admin consent requests" to "Yes".
- Configure the users, groups, or roles authorized to approve requests. (Typically, the Global Administrator is specified.)
2. Request Steps
- Initiate the Entra ID integration in Josys.
- A screen displaying "Need admin approval" will appear.
- Click "Request approval".
3. Approval Steps by the Global Administrator
- Check the approval request email sent to the designated approver.
- Click "Review request".
- Review the details and click "Accept".
Accounts Imported into Josys
Only accounts with a "User type" of Member in Microsoft Azure will be synchronized to Josys.
List of Permissions Granted from Microsoft 365 to Josys
AuditLog.Read.All: Read all audit log data
Directory.ReadWrite.All: Read and write directory data
User.ReadWrite.All: Read full profiles of all users
Enforcing Microsoft 365 MFA from Josys
You can enforce MFA directly from Josys. Please follow the steps below.
- After completing the app integration, click the three-dot ellipsis icon in Josys to display the "Enforce MFA" menu. Use this option when you want to additionally enforce MFA for specific users.
- After clicking, a confirmation screen will appear. Click "Enforce MFA".
- Go to the user screen in Microsoft Entra ID, click "Per-user MFA", and verify the MFA status of the target user. It will be updated to "Enabled". From then on, MFA will be enforced upon logging into Entra ID.