This document provides instructions to configure the Microsoft Office 365 Endpoints integration with the Threat Exchange module of the Netskope Cloud Exchange platform. Use this plugin to fetch URLs from Microsoft Office 365 Endpoints. This plugin does not support sharing of indicators to Microsoft Office 365 Endpoints.
- Microsoft provides dynamic information regarding Office 365, specifically what URLs and IPs each O365 service is under.
- This information is updated periodically.
- Adding this information in Cloud Exchange and the Netskope tenant provides automatic synchronization of the information into web categories.
- These categories can be used in SSL decryption policies, Real-time Protection policies, and SAML authentication bypass.
Prerequisites
To complete this configuration, you need:
- A Netskope tenant (or multiple, for example, production and development/test instances).
- A Secure Web Gateway subscription for URL sharing.
- A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
Microsoft Office 365 Endpoints Plugin Support
| Fetched indicator types | URL |
Workflow
- Configure the Microsoft Office 365 Endpoints plugin.
- Configure sharing for the Microsoft Office 365 Endpoints plugin.
Click play to watch a video.
Configure the Microsoft Office 365 Endpoints Plugin
- In Cloud Exchange, go to Settings > Plugins.
- Search for and select the Microsoft Office365 Endpoints plugin box to open the plugin creation page.
- Enter a Configuration Name
- Adjust the Sync Interval to the appropriate value: Suggested is 5+ minutes.
- Enter Aging Criteria.
- Adjust the Override Reputation to the appropriate value.
- Click Next.
- Select an Instance. Supported values are, Worldwide, China, Germany, USGovDoD, and USGovGCCHigh.
- Select the Service Area Display Name. Supported values are, Exchange Online, Microsoft 365 Common and Office Online, Skype for Business Online and Microsoft Teams, SharePoint Online and OneDrive for Business. Keep this field empty to fetch URLs from all the Service Areas.
- Click Save.
Configure Sharing for Netskope and Microsoft Office 365 Endpoints
- In Threat Exchange, go to Sharing.
- Click “Add Sharing Configuration.
- For Source Configuration, select Microsoft Office 365 Endpoints plugin name you created previously.
- Select the appropriate Business Rule from the second dropdown.
- For Destination Configuration, choose Netskope.
- Select Add to URL List in the Target dropdown.
- Select the List Name, or select Create new list from the dropdown, and then enter a new List Name.
- Select Add to URL List.
- Enter a List Size.
- Enter the Default URL.
- Click Save.
