Calibrant
← Back to Docs

Connect Microsoft 365 (optional)

This is not required to run a scan. Tenant Healthcheck and Security Baseline authenticate entirely through the relay's Managed Identity, which lives in your own Azure subscription. If you have deployed a relay, you can scan without ever completing this step.

Then why connect at all?

To confirm your relay is bound to the tenant you think it is. A relay is deployed into your Azure subscription with its own Managed Identity, and nothing about that identity names an organisation. Connecting Microsoft 365 records your tenant's display name and directory ID, which gives Calibrant a second, independent statement of which tenant you intend to audit — so a relay pointed at the wrong directory can be spotted rather than silently producing a clean-looking report about somebody else's environment.

It also replaces “Microsoft 365 Tenant” with your real organisation name throughout the dashboard and printable reports.

Calibrant makes exactly one Graph call during this flow —GET /v1.0/organization — and then discards the access token. No Microsoft token is stored, and no refresh token is requested.

Prerequisites

  • A Microsoft 365 commercial cloud tenant with an active subscription. Microsoft 365 GCC, GCC High, DoD, China/21Vianet, and every other sovereign or national cloud are not supported.
  • Global Administrator or Application Administrator role in Entra ID
  • A Calibrant account — sign up here

Connect your tenant

  1. Sign in to Calibrant and navigate to Connections in the sidebar.
  2. Click the Connect button on the Microsoft 365 card.
  3. You'll be redirected to Microsoft's login page — sign in with your admin account.
  4. Review the permissions and click Accept to grant admin consent.
  5. You'll be redirected back to Calibrant with a success banner.
What permissions are requested? Two delegated, read-only scopes:User.Read and Organization.Read.All. Nothing else — noDirectory.Read.All, no write permissions, and no offline_access, so Calibrant cannot hold durable access to your tenant through this connection.

After connecting

The Connections page will show your tenant name, status, and connection date. Next, deploy the Calibrant Relay so scans can run against your tenant.

Revoking access

  1. Go to Entra ID → Enterprise applications.
  2. Find Calibrant and remove the consent.
  3. Optionally, delete the connection from Calibrant's Connections page.