Register FortiCASB with Microsoft Identity Platform

In order to use identity and access management compatibilities of Microsoft Entra ID in accessing Office 365 resources, a registered FortiCASB application needs to be created first in the Microsoft Entra admin center.

Prerequisite

A Microsoft Entra ID tenant.

An Office 365 account that has Global Administrator role.

FortiCASB Application Registration

1. Sign in to Microsoft Entra Admin Center with an account that has Global Administrator role.
2. If you have multiple tenants, click on Settings icon in the top menu, then go to Directories + subscriptions to select the tenant which will register the application with.



3. In the Azure search field, search and go to App registrations.



4. Click New registration to create a new app registration.
5. Enter a name for the application.
6. In Supported account types, select "Accounts in this organizational directory only" to make the application only available to users under the same tenant.



7. Do not enter anything for Redirect URI (optional).
8. Click Register to complete the app registration.
9. After the registration is completed, you will be re-directred to the app registration's Overview pane, record down Application (client) ID and Directory (tenant) ID.



10. From the side panel, click Certificates & secrets to see Client secrets pane. If you have not setup a client secret yet, create a client secret and record down the Value.

Continue to Add API Permissions to finish the rest of the configurations.

Add API Permissions

1. Click on API Permissions from the side panel to add API permissions.
2. Click +Add a permission and select Microsoft Graph then select Application permissions type.



3. Search for the Microsoft Graph permissions from the table below and add them.



4. Click +Add a permission again and select Office 365 Management APIs, then select Application permissions type.
5. Search for the Office 365 Management APIs permissions from the table below and add them.
6. Click Grant admin consent for fortinet to grant consent for the API permissions for all Office 365 account users under the same tenant.

Microsoft Graph	Office 365 Management APIs
Directory.Read.All	ActivityFeed.Read
Domain.Read.All	ActivityFeed.ReadDlp
Files.ReadWrite.All	ServiceHealth.Read
Group.Read.All
GroupMember.Read.All
PrivilegedAccess.Read.AzureAD
PrivilegedAccess.Read.AzureResources
Sites.ReadWrite.All
User.Read
User.Read.All
InformationProtectionPolicy.Read.All (This API permission is for Azure Information Protection)

Make sure all the API permissions are in Granted for fortinet(tenant) status.