Microsoft 365
Connect Microsoft 365 to Trefur to see Copilot activity and audit-log entries from every Microsoft AI surface in your tenant.
What you get
- Microsoft Graph audit logs — sign-ins, role assignments, integration grants.
- Copilot activity — Copilot interactions surfaced through the Office 365 Management Activity feed.
- Service-principal inventory — the app registrations and service principals in your tenant.
Setup
- Sign in to app.trefur.com with a tenant Global Administrator account.
- Open Sources → Connections → Microsoft 365 → Connect.
- Confirm the scope list. You're bounced to Microsoft's consent screen.
- Grant admin consent. Trefur runs an instant initial scan; subsequent polls are incremental.
Permissions requested
Microsoft asks for permissions in separate steps, each shown on its own consent screen. All are delegated, for your tenant only.
| Permission | Step | What it grants |
|---|---|---|
AuditLog.Read.All | Discovery | Read directory audit and sign-in logs. |
Directory.Read.All | Discovery | Read the applications in your Entra tenant, the permissions granted to them, and your users (member accounts count as monitored employees; guest accounts do not). |
DelegatedPermissionGrant.ReadWrite.All, AppRoleAssignment.ReadWrite.All | Governance (separate, opt-in) | Used only when an owner or admin of your Trefur workspace removes an app's access and confirms with a second factor: deletes the permission grants and application permission assignments that app holds in your tenant. |
ActivityFeed.Read (Office 365 Management APIs) | Microsoft Copilot audit connector | Read the Copilot audit feed. Trefur starts a subscription to the feed's content types. |
user_impersonation (Azure Service Management), Data.Read (Log Analytics) | Azure AI Foundry and Azure OpenAI audit connectors | Read Azure OpenAI accounts and Log Analytics diagnostic logs, with the access the connecting administrator holds. |
openid, offline_access | Discovery | Confirm which tenant consented; keep the connection alive without a re-prompt. |
Connect Microsoft Discovery first: each connector is approved in the tenant your workspace already connected, and its permission is asked for only when you connect that connector. Signing in to Trefur with Microsoft is separate and accepts work and school accounts only.
Disconnect
In the Trefur dashboard, open the integration and click Disconnect. Trefur revokes the refresh token immediately.