https://bluelanternsecurity.io/OutlookOrgIntegration-CVwU5YaV.js

1import{j as e,P as u,B as c,I as d,L as s,aj as g,T as y,a6 as a,ay as f,aC as b,a4 as h,y as j,r as w,d as N,e as v,f as n}from"./index-C86sjUM7.js";import{O as A,P as k,Q as E,R as I,T as S,U as R,V as m,f as P,C as M,h as O,j as _,k as T}from"./integrations-DtPDPoSE.js";import{T as C}from"./terminal-DYk-WSdK.js";import{B as L}from"./bot-C2_bjxVn.js";import{S as G}from"./shield-alert-cz1iZj9B.js";function t({title:i,note:r,command:l}){const[x,o]=w.useState(!1),p=()=>{navigator.clipboard.writeText(l),o(!0),setTimeout(()=>o(!1),1500)};return e.jsxs("div",{className:"rounded-xl border border-slate-800 bg-slate-950/50 p-4",children:[e.jsxs("div",{className:"flex items-start justify-between gap-3",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("p",{className:"text-sm font-semibold text-white",children:i}),r&&e.jsx("p",{className:"mt-1 break-words text-xs text-slate-400",children:r})]}),e.jsx("button",{type:"button",onClick:p,className:"shrink-0 rounded-md p-1.5 text-slate-400 transition-colors hover:bg-slate-800 hover:text-white",title:"Copy command","aria-label":`Copy command: ${i}`,children:x?e.jsx(N,{className:"h-4 w-4 text-emerald-400"}):e.jsx(v,{className:"h-4 w-4"})})]}),e.jsx("pre",{className:"mt-3 overflow-x-auto rounded-lg border border-slate-800 bg-slate-950 p-3 font-mono text-xs leading-relaxed text-cyan-300/90",children:l})]})}t.propTypes={title:n.string.isRequired,note:n.node,command:n.string.isRequired};function B(){return e.jsxs("div",{className:"min-h-screen bg-slate-950 px-4 pb-12 pt-24 text-white sm:px-6",children:[e.jsx(u,{title:"Outlook Org Integration — Microsoft 365 mailbox monitoring | Blue Lantern Security",description:"Monitor every Microsoft 365 mailbox in your tenant via the Graph API integration. Entra app registration, real-time analysis, and optional auto-quarantine to Junk Email.",path:"/outlook-org-integration"}),e.jsxs("div",{className:"mx-auto max-w-5xl space-y-6 sm:space-y-8",children:[e.jsxs("div",{className:"relative rounded-3xl border border-slate-800 bg-slate-900 p-6 shadow-2xl sm:p-8",children:[e.jsx("div",{className:"pointer-events-none absolute inset-0 overflow-hidden rounded-3xl",children:e.jsx("div",{className:"absolute -right-16 -top-16 h-64 w-64 rounded-full bg-cyan-400/10 blur-3xl"})}),e.jsxs("div",{className:"relative z-10",children:[e.jsxs("div",{className:"mb-3 inline-flex items-center gap-2 rounded-full border border-cyan-500/20 bg-cyan-500/10 px-3 py-1 text-xs font-semibold uppercase tracking-wider text-cyan-300",children:[e.jsx(c,{className:"h-3.5 w-3.5"}),"Continuous monitoring"]}),e.jsxs("h1",{className:"flex items-center gap-3 text-2xl font-bold sm:text-3xl",children:[e.jsx(d,{className:"h-8 w-8 shrink-0 text-cyan-300"}),"Outlook Org Integration"]}),e.jsx("p",{className:"mt-3 max-w-2xl text-sm text-slate-400 sm:text-base",children:"Monitor every Microsoft 365 mailbox in your tenant through the Graph API — no per-user add-in installs. One setup pulls your directory, assigns seats, and analyzes incoming mail for phishing within seconds of arrival."}),e.jsxs("div",{className:"mt-5 flex flex-wrap gap-3",children:[e.jsxs(s,{to:"/integrations",className:"inline-flex items-center gap-2 rounded-lg bg-cyan-600 px-5 py-2.5 text-sm font-semibold text-white transition-colors hover:bg-cyan-500",children:[e.jsx(g,{className:"h-4 w-4"}),"Set up in Integrations"]}),e.jsxs(s,{to:"/monitoring-hub",className:"inline-flex items-center gap-2 rounded-lg border border-slate-700 bg-slate-900/60 px-5 py-2.5 text-sm font-semibold text-slate-200 transition-colors hover:border-slate-600 hover:text-white",children:[e.jsx(c,{className:"h-4 w-4"}),"Open Monitoring Hub"]})]}),e.jsx("div",{className:"mt-4",children:e.jsx(y,{})})]})]}),e.jsxs("div",{className:"flex items-start gap-3 rounded-2xl border border-amber-500/20 bg-amber-500/5 p-5 text-sm",children:[e.jsx(a,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-slate-300",children:[e.jsx("p",{className:"font-semibold text-amber-300",children:"A Microsoft 365 administrator is required"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["Setup involves privileged actions in your own Microsoft consoles: an"," ",e.jsx("span",{className:"text-slate-300",children:"Entra ID administrator"})," registers the app and grants admin consent, and — recommended, not required — an"," ",e.jsx("span",{className:"text-slate-300",children:"Exchange administrator"})," runs a short PowerShell script to narrow which mailboxes the credential can reach. A Blue Lantern account admin can start the wizard and hand those steps to the right people; every value they need is shown copy-ready."]})]})]}),e.jsxs("div",{className:"grid gap-4 sm:grid-cols-3",children:[e.jsxs("div",{className:"rounded-2xl border border-slate-800 bg-slate-900 p-5",children:[e.jsx(f,{className:"h-5 w-5 text-cyan-400"}),e.jsx("h2",{className:"mt-3 text-sm font-semibold text-white",children:"Whole-tenant coverage"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"An app registration you own, with permissions you consent to, reads mailboxes directly through Microsoft Graph — every user is covered with nothing to install."})]}),e.jsxs("div",{className:"rounded-2xl border border-slate-800 bg-slate-900 p-5",children:[e.jsx(b,{className:"h-5 w-5 text-cyan-400"}),e.jsx("h2",{className:"mt-3 text-sm font-semibold text-white",children:"Real-time analysis"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Graph change notifications push new mail to us as it lands; suspicious messages are analyzed within seconds and appear in the Monitoring Hub with a verdict. Subscriptions are created and renewed automatically — nothing for you to configure."})]}),e.jsxs("div",{className:"rounded-2xl border border-slate-800 bg-slate-900 p-5",children:[e.jsx(h,{className:"h-5 w-5 text-cyan-400"}),e.jsx("h2",{className:"mt-3 text-sm font-semibold text-white",children:"Seats assigned automatically"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Members of your monitored group are seated up to your purchased 

1seat count; the rest join unmonitored until you add seats. Ingestion is seat-only."})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsx("h2",{className:"text-lg font-semibold text-white",children:"How setup works"}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Our guided wizard presents each Microsoft-side step with copy-ready values, then validates the connection live before storing anything."})]}),e.jsxs("ol",{className:"divide-y divide-slate-800/60",children:[e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"1"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Start the wizard in our UI"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["Open ",e.jsx("span",{className:"text-white",children:"Account → Integrations"})," (or the button above), click"," ",e.jsx("span",{className:"text-white",children:"Add Integration"}),", and choose"," ",e.jsx("span",{className:"text-white",children:"Microsoft 365 / Outlook"}),". The first step asks one decision up front: whether to allow the optional ",e.jsx("span",{className:"text-white",children:"auto-quarantine"})," action, which adds a write permission."]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"2"}),e.jsxs("div",{className:"min-w-0",children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Entra ID: register an app and consent"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["Register a single-tenant app, add these ",e.jsx("span",{className:"text-white",children:"application"})," permissions (not delegated), and grant admin consent:"]}),e.jsxs("ul",{className:"mt-2 space-y-1 font-mono text-xs text-cyan-300/90",children:[e.jsx("li",{children:A}),e.jsxs("li",{children:[k," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(directory)"})]}),e.jsxs("li",{children:[E," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(resolve the monitored group)"})]}),e.jsxs("li",{children:[I," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(only for auto-quarantine)"})]}),e.jsxs("li",{children:[S," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(only for the optional MFA and dormancy checks; dormancy also needs an Entra ID P1/P2 license)"})]}),e.jsxs("li",{children:[R," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(only for the optional auto-forwarding and inbox-rule checks)"})]}),e.jsxs("li",{children:[m," ",e.jsx("span",{className:"font-sans text-slate-500",children:"(only for the optional AI exposure scan)"})]})]}),e.jsxs("p",{className:"mt-2 text-sm text-slate-400",children:["Then set ",e.jsx("span",{className:"text-white",children:"Assignment required? → No"})," in Enterprise applications → Properties. Microsoft only signs the change notifications we require when this is set; otherwise it delivers a null token and every notification is rejected. If tenant policy forbids it, assign the Graph Change Tracking service principal a role on the app instead:"]}),e.jsx("p",{className:"mt-2 break-all font-mono text-xs text-cyan-300/90",children:P})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"3"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Create a credential"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["A ",e.jsx("span",{className:"text-white",children:"certificate"})," is preferred — we read its expiry directly and warn you before it lapses. A client secret works too, but you must supply its expiry date, and Entra caps secrets at 24 months (often less by tenant policy). Commands are below."]}),e.jsxs("p",{className:"mt-2 flex items-start gap-1.5 text-sm text-amber-400/90",children:[e.jsx(a,{className:"mt-0.5 h-4 w-4 shrink-0"}),"An expired credential silently stops monitoring. We track the date and surface a warning on the Integrations page well before it matters."]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"4"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Scope the mailboxes (recommended)"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["Create a mail-en

1abled security group of the mailboxes to monitor and apply an"," ",e.jsx("span",{className:"text-white",children:"Application Access Policy"})," restricting the app to it. The wizard generates this PowerShell with your real values. It is recommended rather than required — you can connect without it after an explicit acknowledgement, which we record."]}),e.jsxs("p",{className:"mt-2 text-sm text-slate-400",children:["The group is required either way: it defines ",e.jsx("span",{className:"text-white",children:"who we analyze and seat"}),". The policy narrows what the credential itself can reach."]})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx("span",{className:"flex h-8 w-8 shrink-0 items-center justify-center rounded-full bg-cyan-500/10 text-sm font-bold text-cyan-300 ring-1 ring-cyan-500/30",children:"5"}),e.jsxs("div",{children:[e.jsx("h3",{className:"text-sm font-semibold text-white",children:"Connect and verify"}),e.jsxs("p",{className:"mt-1 text-sm text-slate-400",children:["Enter the tenant id, app id, credential and group. We authenticate to Graph, confirm consent, and check the scope by proving an in-group mailbox is readable and an out-of-group one is not. If the proof does not pass, your configuration is ",e.jsx("span",{className:"text-white",children:"saved as pending"})," — nothing needs re-entering — and you can verify later without redoing the form. Once it passes, your directory is pulled, seats are assigned, and subscriptions are armed automatically."]})]})]})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsxs("h2",{className:"flex items-center gap-2 text-lg font-semibold text-white",children:[e.jsx(C,{className:"h-5 w-5 text-cyan-400"}),"Commands you will need"]}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"The wizard shows these with your values substituted. They are here so an admin can prepare ahead, or hand the Exchange step to someone else."})]}),e.jsxs("div",{className:"space-y-4 p-5 sm:p-6",children:[e.jsx(t,{title:"Create a certificate (OpenSSL, any platform)",note:e.jsxs(e.Fragment,{children:["Upload the resulting ",e.jsx("span",{className:"font-mono",children:"bluelantern-cert.pem"})," to Entra (Certificates & secrets), and give the wizard both halves. ",e.jsx("span",{className:"font-mono",children:"-nodes"})," means no passphrase — a protected key cannot be used unattended and will fail at connect. RSA 2048–4096 only."]}),command:M}),e.jsx(t,{title:"Create a certificate (PowerShell, Windows)",note:"Exports a .cer for Entra and a .pfx you extract the private key from.",command:O}),e.jsx(t,{title:"Extract the private key from the .pfx",note:e.jsxs(e.Fragment,{children:["The ",e.jsx("span",{className:"font-mono",children:".pfx"})," is not directly usable — the private key must reach us as PEM. Delete the ",e.jsx("span",{className:"font-mono",children:".pfx"})," and its password afterwards."]}),command:_}),e.jsx(t,{title:"Restrict which mailboxes the app can read (Exchange Online PowerShell)",note:"Recommended. Replace the placeholders with your admin UPN, app id, domain, and the mailboxes to monitor. Exchange can take 30–60 minutes to enforce a new policy, so a connect attempt right after this may need one retry.",command:T({})})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsxs("h2",{className:"flex items-center gap-2 text-lg font-semibold text-white",children:[e.jsx(L,{className:"h-5 w-5 text-indigo-300"}),"Optional: daily AI exposure scan"]}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"Which AI tools can touch your tenant's data — the inventory insurers and customers have started asking for. Enable it with one checkbox in the integration's Settings."})]}),e.jsxs("div",{className:"space-y-4 p-5 sm:p-6 text-sm",children:[e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-white",children:"How it works"}),e.jsx("p",{className:"mt-1 text-slate-400",children:"Once a day we enumerate the third-party apps in your tenant through Graph — every service principal, delegated OAuth grant, and application-permission assignment — and classify each grant: whether the app is a known AI tool (a curated catalog plus name heuristics), how far its scopes reach (mail, files, and calendars versus sign-in only), whether the grant is a single user's or org-wide admin consent, and whether the publisher is verified. Unverified apps holding data scopes are flagged too — the classic OAuth-phishing shape, AI or not."})]}),e.jsxs("div",{children:[e.jsx("p",{className:"font-semibold text-white",children:"Where results land"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["Each scan is an AI Exposure run in the"," ",e.jsx(s,{to:"/monitoring-hub",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"Monitoring Hub"})," ","with per-app check rows and an exportable report. The first scan records a baseline; after that, newly appearing risky apps lead the report and can trigger"," ",e.jsx(s,{to:"/documentation/platform/alerts",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"alert rules"})," ","on the AI Exposure run type. An AI exposure section also appears in the attestation report."]})]}),e.jsxs("p",{className:"flex items-start gap-1.5 text-xs text-amber-400/90",children:[e.jsx(a,{className:"mt-0.5 h-3.5 w-3.5 shrink-0"}),"Requires the ",m," application permission with admin consent (step 2 above). If it was not granted at connect time, grant it and re-run the connect flow. The scan reads grant metadata only — app identities and scope strings, never message or file content — and mail monitoring continues unaffected either way."]})]})]}),e.jsxs("div",{className:"overflow-hidden rounded-2xl border border-slate-800 bg-slate-900",children:[e.jsxs("div",{className:"border-b border-slate-800 p-5 sm:p-6",children:[e.jsxs("h2",{className:"flex items-center gap-2 text-lg font-semibold text-white",children:[e.jsx(G,{className:"h-5 w-5 text-amber-400"}),"Sensitive actions, and how exposure is limited"]}),e.jsx("p",{className:"mt-1 text-sm text-slate-400",children:"This integration reads mailboxes across your tenant. What you are granting, and the corresponding controls:"})]}),e.jsxs("ul",{className:"divide-y divide-slate-800/60",children:[e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx(d,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-semibold text-white",children:"Application permissions are tenant-wide by default"}),e.jsx("p",{className:"mt-1 text-slate-400",children:"Unlike delegated access, Graph application permissions reach every mailbox in the tenant unless an Application Access Policy narrows them. We check whether one is enforced and record the outcome — verified, unproven, or knowingly accepted (stored with who acknowledged it and when). Independently of Exchange, our ingest worker refuses any mailbox without a seat, so the set of mail we actually analyze is bounded by your seat assignments either way."})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx(h,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-semibold text-white",children:"Credential custody"}),e.jsx("p",{className:"mt-1 text-slate-400",children:"The certificate private key (or client secret) is transmitted once over TLS and stored in AWS Secrets Manager — never in our database, and never returned by any API. Deleting the credential in Entra, or removing the app registration, revokes our access immediately and entirely from your side."})]})]}),e.jsxs("li",{className:"flex gap-4 p-5 sm:p-6",children:[e.jsx(j,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-sm",children:[e.jsx("p",{className:"font-semibold text-white",children:"What we read, keep, and write"}),e.jsx("p",{className:"mt-1 text-slate-400",children:"Permissions are read-only unless you enable auto-quarantine, which adds one write scope used solely to move a flagged message to Junk Email — never to delete or send. Raw message payloads auto-delete within 24 hours and analysis reports within 90 days. Change notifications carry no mail content, and every one is verified as Microsoft-signed and bound to your tenant before we act on it."})]})]})]})]}),e.jsxs("div",{className:"flex items-start gap-3 rounded-2xl border border-amber-500/20 bg-amber-500/5 p-5 text-sm",children:[e.jsx(a,{className:"mt-0.5 h-5 w-5 shrink-0 text-amber-400"}),e.jsxs("div",{className:"text-slate-300",children:[e.jsx("p",{className:"font-semibold text-amber-300",children:"Seats and billing"}),e.jsxs("p",{className:"mt-1 text-slate-400",children:["Requires an active seat plan. Members of your monitored group are seated up to your purchased count and unseated mailboxes are not ingested; if the sync reports unmonitored users, ",e.jsx(s,{to:"/organization",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"add seats"})," and re-sync. See ",e.jsx(s,{to:"/pricing",className:"text-cyan-400 hover:text-cyan-300 hover:underline",children:"pricing"}),"."]})]})]})]})]})}export{B as default};