# Microsoft 365 Agent The Microsoft 365 agent completes the [Microsoft 365 assessment](https://wiki.cyberguard.srl/cat/assessment/microsoft-365.md) with the data the portal cannot read directly: Exchange Online, Microsoft Defender, Purview, SharePoint, Teams and mailbox statistics. The agent does not ask anyone to sign in at every run: it authenticates with a **certificate** dedicated to the machine where it runs. ## Requirements - A Windows machine with Internet access. It can be the same machine used for the Active Directory agent. - The [Microsoft Entra app](https://wiki.cyberguard.srl/cat/onboarding/entra-app.md) registered in your tenant. - For the first configuration only, a Global Administrator of your tenant, to assign the required role to the CyberGuard app. ## First Configuration 1. In **Assessment → Microsoft 365**, click **Download ZIP** and extract `CyberGuard-M365Agent.exe`. 2. Click **Download config**, confirm, copy the **installation code** and download `config.dat` (see [Agents & Probes](https://wiki.cyberguard.srl/cat/agents.md#download-and-configuration)). 3. Copy the EXE and `config.dat` into the **same folder** on the machine. 4. **Only the first time on this machine**, from a prompt opened with "Run as administrator", register the agent certificate: ```powershell .\CyberGuard-M365Agent.exe --NewCertificate --InstallCode "" ``` This step creates the certificate on the machine and, with the sign-in of a Global Administrator, assigns the required role to the CyberGuard app. The same certificate serves every later run on that machine. ## Running the Agent On Demand The Microsoft 365 assessment always starts from the portal: click **Run Assessment** on the Microsoft 365 page. The portal collects what it can through Microsoft Graph; then run the agent to complete the assessment: ```powershell .\CyberGuard-M365Agent.exe --Manual --InstallCode "" ``` The agent completes the latest assessment started from the portal, if it is less than 8 hours old; otherwise it stops and asks you to start a new assessment from the portal first. Before the longest collections (mailbox statistics, SharePoint sites) it asks for confirmation. The data reaches the portal as soon as each service is ready, with mailboxes last: an interruption does not lose what was already sent. The detail page of the assessment shows the progress service by service. ## Running It as a Probe Installed as a Windows service, the agent completes the assessments you start from the portal and the [scheduled](https://wiki.cyberguard.srl/cat/administration/scheduling.md) ones by itself: see [Run as a Service](https://wiki.cyberguard.srl/cat/agents/service.md). ## If Sending Fails ```powershell .\CyberGuard-M365Agent.exe --Resend ``` sends again a scan kept on the machine, without repeating the collection.