INT · Integrations
Connecting Microsoft 365
Step-by-step, including the admin consent screen.
6 min read
AssetSort connects to Microsoft 365 with a tenant-wide connection that a Global Administrator approves once. The sync itself is read-only: it pulls that tenant's licences (with their start and renewal dates), directory users and their account status, Intune and Entra devices, Entra groups, app credentials and MFA/risk signals into AssetSort, and writes nothing back. (The one place AssetSort can act on the tenant is the optional Intune retire command when you offboard someone — see the FAQ below.) The integration requires the Growth plan or above; a managed client inherits its MSP's plan. Owners and admins connect it — and an MSP technician can for a client assigned to them. One Microsoft 365 tenant can be connected to one AssetSort organisation at a time — an organisation whose connection to it is failing still holds it, so if connecting says the tenant is already connected to another organization, disconnect it there first.
- 01
Open Settings → Integrations
From the sidebar, go to Settings, then Integrations under the Platform group. You'll see the Microsoft 365 card with a Connect button (locked below the Growth plan).
- 02
Select Connect
A short dialog explains what AssetSort will read. Select Next, and it asks who needs to approve — AssetSort never sees your Microsoft password either way.
- 03
Approve as a Global Administrator — or send the link
Connecting requires a one-time approval by the tenant's Global Administrator. If you hold the client's admin login, choose Continue to Microsoft and approve it yourself on Microsoft's own consent page. If the client holds the keys, use Copy consent link instead and send them the link — they approve in their own browser, and the card notices within a couple of minutes. A consent link works once and expires after 48 hours; copy a fresh one if it lapses.
- 04
Back in AssetSort, open Integrations
Once you've approved, Microsoft sends you back to AssetSort's Settings. Open Integrations: the Microsoft 365 card shows the tenant as connected and the first sync starts. If the client approved from a link you sent, select Sync now on the card to pull everything in straight away rather than waiting for the overnight sync. Licences, people, devices, groups and app credentials all populate on that first pass; it usually completes within a few minutes.
- 05
Decide whether to follow account status
The card's "Follow Microsoft 365 account status" switch (on by default) lets the sync mark someone as left when their Microsoft 365 account is disabled, they hold nothing AssetSort tracks and they have no AssetSort access to this organisation, and reinstate them if the account comes back — see People. The card also warns you when sign-in tracking is unavailable: it needs a Microsoft Entra ID P1 licence, and without it the dormant-user checks have nothing to go on.