How to integrate ThreatLocker with Microsoft 365?

This document outlines the step-by-step process of how to integrate ThreatLocker with Microsoft 365.

This article is a part of our ThreatLocker How-to Guides series, Chapter 12 – Integration & Third-party Tools.

Introduction

Integrating ThreatLocker with Microsoft 365 allows you to sync and manage users, groups, and directory information directly from your Microsoft environment, enhancing security and automation.

Implementation

Step 1: Check the Agent Status in the ThreatLocker Portal

1. Log in to the ThreatLocker Portal.
2. Navigate to Integrations from the left sidebar.
3. Search for Microsoft 365 and click on it.

4. A window will appear requesting the Tenant ID. You will obtain this in the next step.

Step 2: Get the Tenant ID from Microsoft Entra ID

1. Log in to the Azure Portal.
2. Click on Microsoft Entra ID.

3. Go to App Registrations and click New Registration.

4. Fill out the registration form:

• Name: ThreatLocker Integration
• Supported account types: Select Accounts in this organizational directory only (Single Tenant)

5. Click Register.

6. After registration, you will see application details such as:

• Application (client) ID
• Object ID
• Directory (tenant) ID

7. Click Certificates & Secrets and create a new secret:

• Description: ThreatLocker Secret
• Expires: Choose duration (e.g., 365 days)

Click Add and save the generated value securely.

8. Go to API Permissions:

• Click Add a permission
• Select Microsoft Graph

Choose Application Permissions:

• Add the following permissions:
  • Directory.Read.All

• Group.Read.All

Click Add Permissions to confirm.

Step 2: Complete the Integration in ThreatLocker

1. Return to the ThreatLocker Portal > Integrations > Microsoft 365.
2. Enter the Tenant ID obtained from Microsoft Entra ID.
3. Select Microsoft Graph as the API type.
4. Click Create to finalize the integration.

5. If the process is successful, a confirmation message will appear, and Microsoft 365 will be listed in your Integrations section.

Conclusion

By integrating Microsoft 365 with ThreatLocker, you can centralize user and group synchronization, streamline policy application, and ensure your directory is always up to date with your security platform.