Skip to main content

Microsoft Agent 365 - User Guide

In this article, you will understand step by step how to integrate Scytale with Microsoft Agent 365

Microsoft Agent 365 is Microsoft's control plane for AI agents, letting organizations discover, secure, and manage the AI agents operating across their environment. Scytale reads your agents, their identities, owners, and activity to build your AI agent inventory.

Required Permissions

  • read: copilot packages

  • read: agent identity

  • read: agent identity blueprint

  • read: user basic

  • read: audit logs query

Scytale follows the least-privilege principle, limiting permission scopes strictly to what's required for reliable audit evidence collection.

How to Connect

  1. In Scytale, go to 'Integrations'.

  2. Search for Microsoft Agent 365 and select 'Connect'.

  3. Paste your tenant ID, client ID & client secret.

  4. Add a connection name — this will be used to differentiate between your connections — and then select 'Connect'.

You have now successfully connected to Microsoft Agent 365.

How to Generate Credentials in Microsoft Agent 365

  1. Sign in to the Microsoft Entra admin center as a Global Administrator or Privileged Role Administrator (needed later for admin consent).

    Note: You can reuse the app registration already set up for another Scytale Microsoft integration, such as Microsoft Entra ID. In that case, skip to step 13 and add the permissions to that app.

  2. Go to 'Entra ID' > 'App registrations'.

  3. Click 'New registration'.

  4. Name: any recognisable name, e.g. Scytale Agent 365.

  5. Supported account types: Single tenant only.

  6. Redirect URI: leave empty. Scytale uses the client credentials flow, so no redirect is needed.

  7. Click 'Register'.

  8. The app opens on its Overview page. Under Essentials, copy the Application (client) ID (Scytale Client ID) and the Directory (tenant) ID (Scytale Tenant ID).

  9. In the app's left menu, go to 'Certificates & secrets'.

  10. On the 'Client secrets' tab, click 'New client secret'.

  11. Enter a description (e.g. Scytale), choose an expiry, and click 'Add'.

    Note: The maximum is 24 months; when the secret expires the integration stops syncing until a new secret is entered in Scytale, so note the date.

  12. Click the copy icon next to the Value column immediately (Scytale Client Secret).

    Note: It is shown only once: after leaving the page it is masked and cannot be copied again, so a new secret would have to be created. Do not copy the Secret ID column — it is not the secret.

  13. In the app's left menu, go to 'API permissions'.

  14. Click 'Add a permission' > 'Microsoft Graph' > 'Application permissions' (not Delegated).

  15. Select required permissions and click 'Add permissions'.

  16. All five appear with Type Application and Status Not granted until admin consent is given in the next step. The default User.Read (Delegated) can be removed; Scytale does not use it.

  17. On the same API permissions page, click 'Grant admin consent for <tenant>' and confirm with 'Yes'.

    Note: Requires a Global Administrator or Privileged Role Administrator; for other roles the button is greyed out.

  18. Every row shows a green check with Status Granted for <tenant>.

    Note: Without this step the token carries no permissions and every Scytale call returns 403.

  19. Enter the Tenant ID, Client ID and Client Secret in Scytale.

Related Articles
Did this answer your question?