CyberGuard
by Inside Technologies Srl

Microsoft 365 Agent

The Microsoft 365 agent completes the Microsoft 365 assessment with the data the portal cannot read directly: Exchange Online, Microsoft Defender, Purview, SharePoint, Teams and mailbox statistics.

The agent does not ask anyone to sign in at every run: it authenticates with a certificate dedicated to the machine where it runs.

Requirements

  • A Windows machine with Internet access. It can be the same machine used for the Active Directory agent.
  • The Microsoft Entra app registered in your tenant.
  • For the first configuration only, a Global Administrator of your tenant, to assign the required role to the CyberGuard app.

First Configuration

  1. In Assessment → Microsoft 365, click Download ZIP and extract CyberGuard-M365Agent.exe.
  2. Click Download config, confirm, copy the installation code and download config.dat (see Agents & Probes).
  3. Copy the EXE and config.dat into the same folder on the machine.
  4. Only the first time on this machine, from a prompt opened with "Run as administrator", register the agent certificate:
.\CyberGuard-M365Agent.exe --NewCertificate --InstallCode "<installation code>"

This step creates the certificate on the machine and, with the sign-in of a Global Administrator, assigns the required role to the CyberGuard app. The same certificate serves every later run on that machine.

Running the Agent On Demand

The Microsoft 365 assessment always starts from the portal: click Run Assessment on the Microsoft 365 page. The portal collects what it can through Microsoft Graph; then run the agent to complete the assessment:

.\CyberGuard-M365Agent.exe --Manual --InstallCode "<installation code>"

The agent completes the latest assessment started from the portal, if it is less than 8 hours old; otherwise it stops and asks you to start a new assessment from the portal first. Before the longest collections (mailbox statistics, SharePoint sites) it asks for confirmation.

The data reaches the portal as soon as each service is ready, with mailboxes last: an interruption does not lose what was already sent. The detail page of the assessment shows the progress service by service.

Running It as a Probe

Installed as a Windows service, the agent completes the assessments you start from the portal and the scheduled ones by itself: see Run as a Service.

If Sending Fails

.\CyberGuard-M365Agent.exe --Resend <file>

sends again a scan kept on the machine, without repeating the collection.