> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/microsoft-365.md).

# Microsoft 365

Microsoft 365 is a cloud-based productivity platform used by over one million companies worldwide. By virtue of its cloud nature, users can collaborate on the same files at any time from any device, while fulfilling security and compliance requirements.

DoControl can be integrated with these Microsoft 365 apps:

* [Microsoft Entra ID](/docontrol-user-guide/integrations/entra-id.md)
* [OneDrive](/docontrol-user-guide/integrations/onedrive.md)
* [SharePoint](/docontrol-user-guide/integrations/sharepoint.md)
* [Teams](/docontrol-user-guide/integrations/teams.md)

## Use cases

Integrating DoControl with Microsoft 365 enables you to detect and prevent unnecessary exposure and address these use cases:

* **Get full inventory visibility -** Discover your data exposure for all assets, internal and external users, permissions, external domains and exposed sites in a single view 
* **Trigger alerts based on file overexposure** - Get real-time event notifications for anomalous activity, such as external or public sharing of sensitive files, 4th party sharing, extensive file downloads, former employees downloading or sharing assets, sharing assets with or by a malicious domain
* **Remediate past exposure** - Leverage on-demand bulk remediation to remove public and organization sharing links, remove external collaborators
* **Remediate future data exposure** - Leverage automated workflows to prevent future exposure, such as prevent external sharing, remove collaborator, remove sharing links, prevent ethical wall violations, prevent sharing with private and personal email accounts, revoke 4th party sharing, notify on ransomware and encryption key uploads

## Required permission scopes

You need these permissions scopes to integrate Microsoft 365 apps with DoControl.

### Microsoft Graph API

<table><thead><tr><th width="150">Scope</th><th>Scope details</th></tr></thead><tbody><tr><td>Files.ReadWrite.All</td><td>Allows the app to read, create, update and delete all files in all site collections, without a signed-in user.</td></tr><tr><td>Application.Read.All</td><td>Allows the app to create, read, update and delete applications and service principals without a signed-in user. Does not allow management of consent grants.</td></tr><tr><td><p></p><p>Application.ReadWrite.OwnedBy</p></td><td>Allows the app to create other applications and fully manage them (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of<strong>.</strong></td></tr><tr><td>Offline_access</td><td>Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.</td></tr><tr><td>Users.Read.All<br></td><td>Allows the app to read user profiles without a signed-in user.</td></tr><tr><td>Directory.Read.All</td><td>Allows the app to read data in your organization's directory, such as users, groups and apps, without a signed-in user.</td></tr><tr><td>Files.Read.All</td><td>Allows the app to read all files the signed-in user can access.</td></tr><tr><td>Sites.Read.All</td><td>Allows the app to read documents and list items in all site collections, without a signed-in user.</td></tr><tr><td>Group.Read.All</td><td>Allows the app to read group properties and memberships, and read the calendar and conversations for all groups, without a signed-in user.</td></tr></tbody></table>

### Microsoft 365

<table><thead><tr><th width="150">Scope</th><th>Scope details</th></tr></thead><tbody><tr><td>ActivityFeed.Read</td><td>Allows the app to read activity data for your organization.</td></tr><tr><td>ActivityFeed.ReadDlp</td><td>Reads DLP policy events including detected sensitive data</td></tr></tbody></table>

{% hint style="info" %}
For more information on Microsoft API scopes, see [here](https://docs.microsoft.com/en-us/graph/permissions-reference).&#x20;
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/microsoft-365.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.