Microsoft 365 Setup

Junto connects to Microsoft 365 through the Microsoft Graph API, giving the AI agent access to users, groups, mail, calendar, SharePoint, Teams, devices, and security across your customer tenants.

For mailbox delegation (Full Access, Send As, Send on Behalf), see Exchange Online Delegation — this requires a separate authorization because Microsoft does not expose these operations through Graph.

How Junto Connects

Junto works through the Microsoft Graph API and the Exchange Online REST API. It does not use Exchange Online PowerShell. A small number of administrative tasks that Microsoft only exposes through PowerShell today aren't available yet — for those, use the native Microsoft admin centers. Everything below is delivered through Graph and the Exchange Online API.

Junto only offers the tools a tenant can actually use. When a tenant is missing the license, product, or permission a feature needs, the agent explains that the capability isn't available for that tenant rather than failing silently.

Prerequisites

• A Microsoft 365 tenant with Global Administrator access
• The tenant must have the required licenses for the features you want to use

Connect via OAuth

1. In Junto, go to the company's Integrations page.
2. Find Microsoft 365 and click Connect.
3. Enter the Tenant ID for the customer's Microsoft account. You can find this in Microsoft Entra admin center under Identity → Overview.
4. Sign in with Global Administrator credentials and accept the requested permissions.
5. After authorization, you are redirected back to Junto with an active connection.

Once connected, the agent has access to all Microsoft Graph API capabilities listed below. For mailbox delegation features (Full Access, Send As, Send on Behalf), you'll also need to set up the Exchange Online Delegation integration.

What the Agent Can Do

Once connected, the agent can help manage your Microsoft 365 environment across the following areas:

• User management -- Look up users, create and update accounts, reset passwords, revoke sessions, manage licenses, and manage managers and reporting lines.
• MFA & authentication methods -- Review which users have MFA registered, see their registered methods, and add or remove phone and email authentication methods.
• Group management -- Browse groups, manage membership and owners, and handle group-level licensing.
• Directory roles -- View directory roles and manage role membership.
• Mail & mailbox -- View mailbox settings, configure out-of-office replies, manage inbox rules, and view or change mail forwarding.
• Calendar -- View and manage calendar events and free/busy.
• SharePoint & OneDrive -- Browse sites and files, create folders, manage sharing, and restore prior file versions.
• Teams -- View teams, manage membership, create channels, and archive teams.
• Devices -- View Intune-managed devices, trigger syncs, retire or wipe devices, and retrieve BitLocker recovery keys.
• Security & identity -- View security alerts, risky users and risk detections, secure score, Conditional Access policies, and named locations.
• Reporting & insights -- Pull usage and activity reports for license optimization and QBRs: email and mailbox activity, mailbox storage and quota, Microsoft 365 group activity, SharePoint site usage, per-user service and app adoption, and MFA registration coverage.
• Audit & reporting -- View sign-in logs, directory audit logs, and message trace.

High-impact actions (account changes, password resets, device wipes, etc.) always require technician approval before the agent proceeds.

Feature Availability by License

Junto exposes only the tools a tenant's licensing supports. If a tenant lacks the license or product a feature needs, the agent will tell you the capability isn't available for that tenant instead of erroring. The main dependencies:

Capability	Requires
Core user, group, Teams, and SharePoint management	Any Microsoft 365 license
Mailbox settings, inbox rules, mail forwarding, calendar, message access	An Exchange Online mailbox on the user
Sign-in logs and sign-in / MFA activity auditing (who signed in, from where, whether MFA was satisfied, Conditional Access results)	Entra ID P1 or P2
Conditional Access policies, named locations, provisioning logs, group-based licensing, BitLocker recovery keys	Entra ID P1 or P2
Identity Protection — risky users, risk detections, risky service principals	Entra ID P2
Intune device management — managed device inventory, compliance and configuration policies, device sync, retire, and wipe	Intune (standalone or via Business Premium / E3 / E5)
Security alerts	A Microsoft Defender product (e.g., Defender for Endpoint or Defender for Office 365)
Message trace	Exchange Online (plus a one-time Exchange service principal setup)
Teams management	A Microsoft Teams license

MFA auditing note: A basic "who has registered MFA" report works on any tenant, but detailed sign-in and MFA activity auditing — actual sign-ins, the methods used at login, and Conditional Access outcomes — depends on the sign-in logs, which require Entra ID P1 or P2. Tenants without P1/P2 won't have this history available.

Troubleshooting

• OAuth connection fails -- Ensure you are signing in as a Global Administrator of the customer's tenant, not your own.
• A capability is unavailable -- The tenant may not have the required license or product. Check the Feature Availability by License table — for example, sign-in and MFA activity auditing needs Entra ID P1 or P2.
• An action can't be performed -- Junto operates through Microsoft Graph and the Exchange Online API, not PowerShell, so a few PowerShell-only administrative tasks aren't supported yet. Use the Microsoft admin centers for those.
• Token expired -- The integration refreshes tokens automatically. If the connection shows "Token expired", disconnect and reconnect.