Integrations overview
Open Settings → Integrations to see connected identity, mail, security, and SIEM services. Cards are hidden or unavailable when the required module or role is missing.
Each connector has its own setup guide. Start with the provider you need:
- Entra ID — directory identity signals and tenant administration.
- Microsoft 365 — mailbox scope, message trace, and ICES analysis.
- Microsoft Defender — XDR alerts, incidents, and analyzed-email signals.
- Splunk HEC — outbound, redacted audit-event delivery.
- Microsoft Sentinel — Azure Monitor Logs Ingestion delivery.
The guides list provider prerequisites, the exact fields shown in EmDash, an ordered consent/configuration flow, verification steps, and recovery guidance for common failures.
Before you start
You need integrations:read to view connection status and integrations:manage to save, test, enable, pause, resume, disable, or rotate a connection. Roles are bundled permission sets; module entitlements are separate. For example, Microsoft 365 requires ICES and Microsoft Defender requires XDR. Read access does not grant mutation access.
Have the provider administrator, tenant or directory identifier, and any endpoint, application, or stream values ready before opening the form. EmDash never asks you to paste an access token. Secrets are accepted only when configuring or rotating a connection, stored server-side, and never returned to the browser.
Delivery health
Integration pages show enabled or paused state, last test, last successful delivery, and aggregate failure health. Transient failures retry with backoff. Authentication, malformed configuration, and permanent provider failures require correction before delivery can resume.