Configuring Tanium Connect

If you did not install Connect with the Apply All Tanium recommended configurations option, you must enable and configure certain features.

No default settings are configured for Connect.

Configure Connect

Configure email server profile settings for Microsoft 365

If you want to configure a connection destination to send email using Microsoft 365, you must first configure an email server profile. Note the following:

• For a walkthrough of configuration prerequisites, Microsoft Azure configuration, email server profile configuration, and connection configuration, see Tanium Community: Use Tanium Connect to Send Microsoft Office 365 Emails using Modern Authentication.

• You must have a Microsoft 365 Outlook email address associated with a Microsoft Entra ID (formerly Azure Active Directory) user.

  Microsoft Entra ID was previously known as Microsoft Azure Active Directory or Microsoft Azure AD.

• You must create a Microsoft Entra ID application and service principal, and assign the Mail.Send and User.Read permissions to the application, to send an email with an attachment up to a total of 3 MB. For more information, see Microsoft Azure documentation: Create an Azure Active Directory application and service principal that can access resources.

• You must also generate aMicrosoft Entra ID application client secret. For more information, see Microsoft Azure documentation: Option 2: Create a new application secret.

• You must also assign the Mail.Send and User.Read permissions to the application to send emails with attachments up to a total of 3 MB. For more information, see Microsoft Azure documentation: Assign a role to the application.

  If a connection run generates no data, no email is sent. However, if you select a saved question source and clear Hide No Results, an email is sent per connection run, regardless of whether data is available.

• If you want to enable sending emails with attachments greater than 3 MB and up to 150 MB (subject to your Microsoft 365 attachment settings), you can assign the Mail.ReadWrite permission to the Microsoft Entra ID application. If you assign this permission, you must allow traffic to outlook.office.com over port 443/TCP and outlook.office365.com over port 443/TCP.

  For the best results, if you assign the Mail.ReadWrite permission, create an access policy and limit Microsoft Entra ID application access to one user. For more information, see Microsoft Graph documentation: Limiting application permissions to specific Exchange Online mailboxes.

• The Email (O365) destination requires an email server profile. The Email (SMTP) destination does not require an email server profile.

  • Configuring an email server profile requires the Email Config Write permission. Sending an email requires the user that configures the connection to have permission to the content set to which you assign the email server profile.

  If you delete an email server profile configuration that is referenced by a scheduled connection, future scheduled instances of that connection fail. For more information, see Issue: Emails using Microsoft 365 fail to send.

• The email server profile uses login.microsoftonline.com for authentication to the graph.microsoft.com host over port 443/TCP. If you want to change the host from graph.microsoft.com, Contact Tanium Support.

• Configure a CMP network egress allow list rule for the following Microsoft 365 URLs to enable access for Microsoft 365 mail resources:

• Configure your network allow list to allow traffic outbound from your Tanium Module Server to the following Microsoft 365 URLs and enable access for Microsoft 365 mail resources:

• graph.microsoft.com:443
• login.microsoftonline.com:443

• outlook.office.com:443 and outlook.office365.com:443 if you assign the Mail.ReadWrite permission to the Microsoft Entra ID application. For more information, see Microsoft 365 documentation: Office 365 URLs and IP address ranges.

For more information, see Configuring email destinations using Microsoft 365.

1. From the Connect Overview page, click Settings , then click the Email Destination Settings tab.

2. Click Create Email Profile.

3. Enter a profile display Name and Description.

4. Enter the Microsoft Azure Tenant ID in hexadecimal UUID format. For more information, see Microsoft Azure documentation: How to find your Azure Active Directory tenant ID.

5. Enter the Microsoft Azure application Client ID in hexadecimal UUID format. For more information, see Microsoft Azure documentation: Sign in to the application.

6. Enter the Microsoft Azure application Client Secret. For more information, see Microsoft Azure documentation: Option 2: Create a new application secret.

7. Enter a Microsoft Entra ID (formerly Azure Active Directory) user User Principal Name attribute or Object ID as the From User (Principal Name or ID). Emails sent using this email server profile display this user in the From field. For more information, see Microsoft Azure documentation: Add or update a user's profile information and settings

   .

8. To verify your configuration, enter an email address in the Send a Test Email field, then click Send Test Email. An email from the configured From User with the subject Tanium Connection Test is sent to this email address. If you receive this email in the email address inbox within the next few minutes, move on to the next step. Otherwise, check the following:

   • Check the recipient email address spam folder and deleted items folder to see if a rule redirected the email from the inbox.

   • Check the sender email address sent email folder to verify that the email was generated and sent.

   • Check that your email server profile settings are correct, including the Tenant ID, Client ID, and Client Secret.

   • Check that your CMP network egress allow list contains properly configured rules for graph.microsoft.com, login.microsoftonline.com, and outlook.office.com.

   • Verify that your network allow list contains properly configured rules for graph.microsoft.com, login.microsoftonline.com, and outlook.office.com.

9. Select a Content Set from the drop-down list to which this email server profile belongs.

   Ensure that users configuring connections using this email server profile can access this content set.

10. Click Create.

Set up Connect users

You can use the following set of predefined user roles to set up Connect users.

To review specific permissions for each role, see User role requirements.

On installation, Connect creates a Connect user to automatically manage the Connect service account. Do not edit or delete the Connect user.

For more information about assigning user roles, see Tanium Core Platform User Guide: Manage role assignments for a user.

Connect Administrator

Assign the Connect Administrator role to users who manage the configuration of Connect.
This role can perform the following tasks:

• Configure Connect settings, including resource allocation and logging
• View, run, and create connections
• Take ownership of connections owned by other users
• Edit and delete owned connections
• Access the Connect REST API

Connect Operator

Assign the Connect Operator role to users who manage the configuration of Connect.
This role can perform the following tasks:

• Configure some Connect settings, including resource allocation and logging
• View, run, and create connections
• Take ownership of connections owned by other users
• Edit and delete owned connections
• Access the Connect REST API

Connect User

Assign the Connect User role to users who work with connections.
This role can perform the following tasks:

• Create connections
• View, run, edit, and delete owned connections

Do not assign the Connect Service Account, Email Service Account, or Email Service Account - All Content Sets roles to users. These roles are for internal purposes only.