Connect your tenant

Mito assesses your Microsoft 365 security configuration every day and shows you what has changed. To do that, it needs a read-only app registration in your tenant. The app can read settings, but it cannot change anything.

Setup takes about 10 minutes and needs a Global Administrator (or a Privileged Role Administrator together with an Application Administrator).

Option A: run our script (recommended)

1. Download the setup script: New-CustomerApp.ps1. It is short and readable; please look through it before you run it.

2. Open PowerShell 7 and install the two Microsoft Graph modules it uses:

   Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Applications -Scope CurrentUser

3. Run the script from the folder you saved it to:

   ./New-CustomerApp.ps1 -SecretMonths 12

4. Sign in as an administrator when prompted and accept the permissions the script asks for (it needs them only to create the app; they are not given to Mito).

The script:

1. creates a single-tenant app registration called Mito Assessment (read-only),
2. grants it the read-only Microsoft Graph application permissions and Exchange.ManageAsApp listed in Permissions explained,
3. assigns the Global Reader directory role to the app,
4. creates a client secret, valid for 12 months by default (-SecretMonths accepts 1 to 24).

At the end it prints the four values to send us. To keep the secret off your screen, add -OutputPath ./mito.json: the values are written to that file, readable only by you.

Tip

On Windows, if PowerShell refuses to run a downloaded script, run Unblock-File ./New-CustomerApp.ps1 first.

Option B: set it up by hand

1. Entra admin center → App registrations → New registration. Name: Mito Assessment (read-only). Supported account types: Accounts in this organizational directory only.
2. API permissions → Add a permission → Microsoft Graph → Application permissions. Add: AgentIdentity.Read.All, AgentIdentityBlueprint.Read.All, AgentIdentityBlueprintPrincipal.Read.All, Application.Read.All, AuditLog.Read.All, DeviceManagementConfiguration.Read.All, DeviceManagementManagedDevices.Read.All, DeviceManagementRBAC.Read.All, DeviceManagementServiceConfig.Read.All, Directory.Read.All, DirectoryRecommendations.Read.All, EntitlementManagement.Read.All, IdentityRiskEvent.Read.All, NetworkAccess.Read.All, OnPremDirectorySynchronization.Read.All, OrgSettings-AppsAndServices.Read.All, OrgSettings-Forms.Read.All, Policy.Read.All, Policy.Read.ConditionalAccess, Reports.Read.All, ReportSettings.Read.All, RoleEligibilitySchedule.Read.Directory, RoleManagement.Read.All, RoleManagementAlert.Read.Directory, SecurityIdentitiesSensors.Read.All, SecurityIdentitiesHealth.Read.All, SharePointTenantSettings.Read.All, ThreatHunting.Read.All, UserAuthenticationMethod.Read.All.
3. Add a permission → APIs my organization uses → Office 365 Exchange Online → Application permissions → Exchange.ManageAsApp.
4. Click Grant admin consent for your organization.
5. Roles and administrators → Global Reader → Add assignments, and select the app.
6. Certificates & secrets → New client secret, valid for 12 months. Copy the Value, not the Secret ID. It is shown only once.

Some permissions (for example the AgentIdentity ones) exist only in tenants where Microsoft has rolled out the feature. If you cannot find one, skip it; the checks that need it are reported as skipped.

Send us the values

Send these over the secure link we gave you. Don’t send them by email.

• Tenant ID
• Application (client) ID
• Client secret value
• Secret expiry date

We check them as soon as you send them and tell you if a permission is missing. We remind you a month before the secret expires, so you can create a new one.

Next: give your people access

Your findings are shown in the Mito portal, and only the people your admin assigns the Mito Reader role can see them. See Give your people access.

Stopping the service

Delete the app registration in your tenant (Entra admin center → App registrations → Mito Assessment (read-only) → Delete). From then on Mito can no longer sign in to your tenant. Let us know as well, so we can remove your results.