Integrations overview
Open Settings → Integrations to see connected identity, mail, security, and SIEM services. Cards are hidden or unavailable when the required module or role is missing.
Entra ID and Microsoft 365
Use Entra ID for directory identity signals and Microsoft 365 for mailbox visibility and synchronization. Microsoft 365 requires the ICES module and integration access. Generate a consent link, approve it as the appropriate Microsoft administrator, and return to EmDash to review connection health, tenant identity, domains, and mailbox scope.
EmDash stores connection state and provider identifiers, not raw access tokens. A consent callback can succeed while a later probe fails; review the last probe and error instead of assuming the connection is healthy.
Microsoft Defender
Microsoft Defender is independently gated by XDR. It uses separate consent and health checks from Microsoft 365. Use the test connection control after consent and review the supported alert, analyzed-email, quarantine, and remediation capabilities.
Splunk HEC
Splunk HEC exports newly created, redacted audit events. Configure an HTTPS HEC endpoint, index, source, sourcetype, and token. EmDash batches events, uses stable event IDs for retry deduplication, and never returns the token after saving. Pause, resume, rotate, or disable a destination from its settings page.
Microsoft Sentinel
Microsoft Sentinel uses the Azure Monitor Logs Ingestion API and a custom table such as EmDashAudit_CL. Provide the ingestion endpoint, immutable DCR ID, stream name, Entra directory ID, client ID, and client secret. The Entra application needs the Monitoring Metrics Publisher role on the DCR. Secrets are stored by reference and are not shown again.
Delivery health
Integration pages show enabled or paused state, last test, last successful delivery, and aggregate failure health. Transient failures retry with backoff. Authentication, malformed configuration, and permanent provider failures require correction before delivery can resume.