Beacon helps your business stay protected against email-based threats. It scans your email environment for signs of business email compromise, scanning for suspicious emails, malicious URLs, unusual sign-in activity (including impossible travel), suspicious forwarding rules, and anomalous sender domains, alongside a range of other threat indicators. With Beacon, your team gains clear, centralised visibility into potential security risks, enabling you to detect and respond to threats quickly before they cause harm.
Before you begin
To complete this integration, you’ll need access to your Azure administration account via portal.azure.com and appropriate permissions (such as Global Administrator or Application Developer) to create and manage app registrations.
Creating an app registration
Go to Azure Active Directory > App registrations > New registration.
Add a name for your Beacon app such as
Beacon Scanner.Supported account types: Single tenant.
Click Register.
Go to API permissions > Add a permission.
Select Microsoft Graph > Application permissions.
Add each of the below permissions:
User.Read.AllMail.ReadBasic.AllMailboxSettings.ReadAuditLog.Read.AllIdentityRiskEvent.Read.AllIdentityRiskyUser.Read.AllGroup.Read.All
Click Grant admin consent - this needs to be done for all the permissions added in the previous step.
Go to Certificates & secrets > New client secret.
Set an expiry, we recommend 12-24 months.
Copy the secret value immediately, as it is only shown once.
Sharing your app registration details
Once the above steps are complete, please create a ticket and share the following details securely using https://onetimesecret.com/en/.
Tenant ID - Found in Azure AD > Overview
Client ID - Found in App Registration > Overview
Client Secret - Created above
We'll then complete the integration and share the results of your first scan.
And that's it! You've successfully integrated with Beacon. 🎉