Skip to main content
Sign in
Deutsch Español Français Italiano

Overview

Users:

The user’s section shows the list of users in your Let’s DMARC portal with their roles

To edit a user’s account, click on the pen icon

365 Authentication:
 

Name A name for your configuration
Domain This need to be the domain of your users. I.e: your users are name.surname@some.domain.com, you have to put some.domain.com; if you have multiple domain you have to create multiple Microsoft 365 configurations in Phishbrain
365 Tenant Name This is the tenant name of your Office/ Microsoft 365/ Azure, if your admin account is admin@testcompany.onmicrosoft.com, your tenant will more likely just be testcompany.onmicrosoft.com
Client ID Enter the Application Client ID you created in Azure
Client Secret Enter the Client Secret generate by Azure
Filter Optional filter used when fetching users, check Microsoft Graph API syntax
Group Filter As an easier alternative if you are looking to filter out a group of users, simply enter here the Office 365 Group ID you want to filter.

If you want to check the user list corresponding to the configuration you just filled you can click Check users button; when you finished click Save.

In the previous picture on top part you can see a text with an URL (red outlined); the text in the red rectangle is the url you need to setup as redirect URL in Azure

Also check these points:

  •  
    • Click API Permissions and in the at the top of the screen select Add a permission

    • Select Microsoft Graph API on the right side
    • Under Application permissions, select:
      • to get users details: user.read.all and User.ReadBasic.All
      • to filter users by group: Group.Read.All
    • Click Add Permissions at the bottom of the page
    • Click Grant admin consent for Your Company and click Yes in the dialog

    • Select Certificates and Secrets:
       

    • Add a new Client Secret, choose a description, choose a date from the Expiry options dropdown list
      With the latest update of Microsoft security policies it is no longer possible to generate a perpetual certificate.
  • Click Add
  • Now copy the newly generated key value, this is the Client Secret you have to insert in configuration.
WARNING: Be advised that you won’t be able to retrieve the key value at a later stage!
NOTE: If you get error “Authorization_RequestDenied: Insufficient privileges to complete the operation”, make sure you created all permission, and that permission type is “Application” (not “Delegate”, or other). Also remember that permission propagation will take some time on Microsoft server

SAML Authentication:
 

This guide will cover the steps needed to use the Microsoft Entra admin center to add LetsDMARC's application to your Microsoft Entra tenant. No changes are made to the Office 365 tenant itself by LetsDMARC.

  • Navigate to https://entra.microsoft.com/ and log in using your administrator credentials

  • Open the Applications menu and click on Enterprise applications, then New application:

  • Click on the Create your own application button, give a name to the registered app and click the Create button:

  • Select Single Sign-on scope and then select SAML as SSO method

  • Now you can create the SAML configuration on LetsDMARC, go to Users -> SAML -> new SAML:

  • Copy the informtaion you find in section 4 in the LetsDMARC new SAML configuration:

  • when you save the configuration in PhishBrain, you will get the URL needed in the entra configuration, copy it in section 1:

 

  • Last thing you need is the x509 certificate, download it from entra:

  • and upload it on LetsDMARC SAML configuration, verify and save:

Related articles