> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prowler.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Prowler product naming: Prowler App is now Prowler Local Server, and Prowler Enterprise is now Prowler Private Cloud. Always use the current names when answering. The full product reference is at /getting-started/products: Open Source projects are Prowler CLI, Prowler Local Server, Prowler Local Dashboard, and Prowler SDK; Prowler Products are Prowler Cloud, Prowler Private Cloud, Prowler Hub, Prowler Lighthouse AI, and Prowler MCP.

# Getting Started With Microsoft 365 on Prowler

<Note>
  **Government Cloud Support**

  Government cloud accounts or tenants (Microsoft 365 Government) are currently unsupported, but we expect to add support for them in the near future.
</Note>

## Prerequisites

Set up authentication for Microsoft 365 with the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide before starting either path:

* Register an application in Microsoft Entra ID
* Grant the Microsoft Graph and external API permissions listed for the provider
* Generate an application certificate (recommended) or client secret
* Prepare PowerShell module permissions to enable every check

<CardGroup cols={2}>
  <Card title="Prowler Cloud" icon="cloud" href="#prowler-cloud">
    Onboard Microsoft 365 using Prowler Cloud
  </Card>

  <Card title="Prowler CLI" icon="terminal" href="#prowler-cli">
    Onboard Microsoft 365 using Prowler CLI
  </Card>
</CardGroup>

## Prowler Cloud

### Step 1: Locate the Domain ID

1. Open the Entra ID portal, then search for "Domain" or go to Identity > Settings > Domain Names.

   <img src="https://mintcdn.com/prowler/cmPhg0PQUNFwgauQ/images/providers/search-domain-names.png?fit=max&auto=format&n=cmPhg0PQUNFwgauQ&q=85&s=6ecba536f9251512628444559f3ed50d" alt="Search Domain Names" width="1204" height="354" data-path="images/providers/search-domain-names.png" />

   <img src="https://mintcdn.com/prowler/VEKBBm2VL7R8-xYV/images/providers/custom-domain-names.png?fit=max&auto=format&n=VEKBBm2VL7R8-xYV&q=85&s=972ae54a1f0507b7ef1fb9bca8c5a56b" alt="Custom Domain Names" width="2038" height="1106" data-path="images/providers/custom-domain-names.png" />

2. Select the domain that acts as the unique identifier for the Microsoft 365 account in Prowler Cloud.

### Step 2: Open Prowler Cloud

1. Go to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).

2. Navigate to "Configuration" > "Providers".

   <img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/prowler-app/cloud-providers-page.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=aa592727864e8328ab2574708df74d34" alt="Providers Page" width="263" height="917" data-path="images/prowler-app/cloud-providers-page.png" />

3. Click "Add Provider".

   <img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/prowler-app/add-cloud-provider.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=793e5a073e1a037e453df158ad7b854d" alt="Add a Provider" width="380" height="80" data-path="images/prowler-app/add-cloud-provider.png" />

4. Select "Microsoft 365".

   <img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/providers/select-m365-prowler-cloud.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=d2ee6d2d35fd02a04a1ca8dc6951188b" alt="Select Microsoft 365" width="1920" height="1080" data-path="images/providers/select-m365-prowler-cloud.png" />

5. Add the Domain ID and an optional alias, then click "Next".

   <img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/providers/add-domain-id.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=41a3089fc012843c3bcadbdcc2a63786" alt="Add Domain ID" width="1920" height="1080" data-path="images/providers/add-domain-id.png" />

### Step 3: Choose and Provide Authentication

After the Domain ID is in place, select the app-only authentication option that matches the Microsoft Entra ID setup:

<img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/providers/m365-auth-selection-form.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=a336e34495d14be181ff5496eaa25703" alt="M365 authentication method selection" width="700" data-path="images/providers/m365-auth-selection-form.png" />

#### Application Certificate Authentication (Recommended)

1. Enter the **tenant ID**, the unique identifier for the Microsoft Entra ID directory.
2. Enter the **application (client) ID**, the identifier for the Entra application registration.
3. Upload the **certificate file content** (Base64-encoded PFX).

<img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/providers/certificate-form.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=4be921d861f07994413e1a4cb671eab0" alt="M365 certificate authentication form" width="700" data-path="images/providers/certificate-form.png" />

Use this method to avoid managing secrets and to unlock all Microsoft 365 checks, including the PowerShell-based ones. Full setup steps are in the [Authentication guide](/user-guide/providers/microsoft365/authentication#application-certificate-authentication-recommended).

#### Application Client Secret Authentication

1. Enter the **tenant ID**.
2. Enter the **application (client) ID**.
3. Enter the **client secret**.

<img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/providers/secret-form.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=bd3d0f7fdcbed33eb8a84532a27b28c8" alt="M365 client secret authentication form" width="700" data-path="images/providers/secret-form.png" />

For the complete setup workflow, follow the [Authentication guide](/user-guide/providers/microsoft365/authentication#application-client-secret-authentication).

### Step 4: Launch the Scan

1. Review the summary, then click **Next**.

   <img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/providers/click-next-m365.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=39b8f405c4648a03176dc86834e59e03" alt="Next Detail" width="1920" height="1080" data-path="images/providers/click-next-m365.png" />

2. Click **Launch Scan** to start auditing Microsoft 365.

   <img src="https://mintcdn.com/prowler/yyJURFHpPIAaK8F3/images/providers/launch-scan.png?fit=max&auto=format&n=yyJURFHpPIAaK8F3&q=85&s=ae7b5ac92f3198e4be067dfb2c1261bf" alt="Launch Scan M365" width="1920" height="1080" data-path="images/providers/launch-scan.png" />

***

## Prowler CLI

### Step 1: Confirm PowerShell Coverage

PowerShell 7.4+ keeps the full Microsoft 365 coverage. Installation options are listed in the [Authentication guide](/user-guide/providers/microsoft365/authentication#supported-powershell-versions).

### Step 2: Select an Authentication Method

Choose the matching flag from the [Microsoft 365 Authentication](/user-guide/providers/microsoft365/authentication) guide:

* **Application Certificate Authentication** (recommended): `--certificate-auth`
* **Application Client Secret Authentication**: `--sp-env-auth`
* **Azure CLI Authentication**: `--az-cli-auth`
* **Interactive Browser Authentication**: `--browser-auth`

### Step 3: Run the First Scan

Run a baseline scan after credentials are configured:

```console theme={null}
prowler m365 --sp-env-auth
```

### Step 4: Enable Full Coverage

Include PowerShell module initialization to run every check:

```console theme={null}
prowler m365 --sp-env-auth --init-modules
```

### Region Selection

By default, Prowler connects to the global Microsoft 365 environment (`M365Global`). To target a different cloud environment, use the `--region` flag:

```console theme={null}
prowler m365 --sp-env-auth --region M365USGovernment
```

Available regions:

* **M365Global** (default): Standard commercial cloud
* **M365China**: China-operated cloud (21Vianet)
* **M365USGovernment**: US Government cloud (GCC High)

***


## Related topics

- [Microsoft 365 Authentication in Prowler](/user-guide/providers/microsoft365/authentication.md)
- [Getting Started With Azure on Prowler](/user-guide/providers/azure/getting-started-azure.md)
- [Getting Started With Cloudflare on Prowler](/user-guide/providers/cloudflare/getting-started-cloudflare.md)
- [Getting Started With Vercel on Prowler](/user-guide/providers/vercel/getting-started-vercel.md)
- [Getting Started With Scaleway on Prowler](/user-guide/providers/scaleway/getting-started-scaleway.md)