Troubleshooting errors in your Microsoft 365 Cloud Connector

Overview

If your Microsoft 365 Cloud Connector is offline (red status) and shows an error message like "Insufficient Permissions" or "Invalid Credentials," we recommend reviewing the error message in Report Builder to see more details. This can help you understand what resolution steps are needed for each of these common scenarios:

• The client secret has expired and must be rotated to a new secret, which is a requirement for secure app access in the integration with Microsoft.
  Note: Blumira also generates a finding for this error as soon as the expiration is detected.
• During the setup of the Cloud Connector, someone mistakenly skipped the step for turning on auditing in the Microsoft compliance portal, or it has since been turned off in Microsoft.
• The Tenant ID used during the configuration was incorrect or no longer exists.

Recommended: Starting with a new Cloud Connector is the fastest way to re-establish logging and ensure the correct credentials are in place for a secure connection, specifically in cases where the exact problem is not clear from the error messages.

Before you begin

This article assumes you have already registered the app in Microsoft Entra that is used by the Blumira integration. If the app no longer exists, you should instead complete the procedure in Integrating with Microsoft 365, which includes creating a new app registration in Microsoft Entra.

If the failing Blumira Cloud Connector is associated with a Microsoft tenant you no longer manage, you can delete the Cloud Connector (Settings > Cloud Connectors > Edit Cloud Connector).

Reviewing error message details in Blumira System logs

To see the full details of the error messages from your Cloud Connector, you can run a report in Report Builder by doing the following:

1. In Blumira, navigate to Reporting > Report Builder. 
2. In Data Sources, select Blumira System.
3. Click Edit Report and then click Add Filter to add optional filters. For example:
   
   • message contains error
   • device_address contains 365
4. Click Submit.
5. Review the message column to see the full error message in each log.

Fixing the error

There may be more than one message that explains the error state for your Cloud Connector. This table explains some of those errors and what to do in each scenario:

Turn on auditing in the Microsoft compliance portal

To ensure that Microsoft auditing is enabled, do one of the following:

• If you use Microsoft Compliance, log in to https://compliance.microsoft.com/auditlogsearch and click Start recording user and admin activity.
• If you use Microsoft Purview, log in to https://purview.microsoft.com/ and navigate to Audit then click Start recording user and admin activity.

Note: Audit logs must be searchable before the integration can be configured. It can take 60 minutes to 72 hours for the change to take effect in Microsoft and before logs can be accessed. Your Cloud Connector may continue to show an error while the Audit change is processing and if the audit log search options are inactive, like in the image below.

Updating your Microsoft credentials

To gather your Microsoft credentials and update your Blumira Cloud Connector, do the following:

1. Log in to the Azure management portal as a Global Admin.
2. Select Microsoft Entra ID.
3. Select the tenant that is associated with the Blumira account you want to send logs to. If you only have a single tenant, continue to the next step.
4. Click App registrations.
5. In the applications list, select your Blumira integration.
6. Copy and save the Application (client) ID and the Directory (tenant) ID to be used in later steps.
   
7. In the lefthand menu, click API Permissions.
8. Verify that permissions have been granted along with admin consent (green checkmark in the status column) for the following APIs:
   • Microsoft Graph API, which requires "User.Read.All" access
   • Office 365 Management API, which requires "ActivityFeed.Read" and "ActivityFeed.ReadDlp" access.
9. If admin consent is not granted (displays a warning icon), click Grant admin consent above the API Permissions table.
   
10. In the lefthand menu, click Certificates & secrets.
11. Click New client secret.
12. In the Description box, type a descriptive name (e.g., Blumira sensor).
13. Next to Expires, select an expiration timeframe up to 24 months for this client secret.
    
    Important: The integration will fail when the client secret expires, so ensure that you set a reminder to update it in Microsoft and in Blumira before the chosen expiration date.
14. Click Add.
15. Under Client secrets, in the Value column, copy the client secret value for the Blumira integration, which you will use in later steps.
    Important: Do not copy the Secret ID, which will not work for the integration.
16. In Blumira, navigate to Settings > Cloud Connectors.
17. Click Add Cloud Connector.
18. In the Available Cloud Connectors window, click Microsoft 365.
19. In the Cloud Connector Name box, type a name to help identify the specific integration.
20. Enter the credentials that you collected in the previous steps.
21. Click Connect.
    
22. To delete the failing connector, open the Edit Cloud Connector details window for the broken connector, then click Remove.