Sync users and groups, investigate accounts and mailboxes through Microsoft Graph, and make changes with workflow actions
SuperIT works with Microsoft 365 in three layers: it syncs users and groups from a connected tenant, it reads Microsoft Graph to answer questions and investigate tickets, and it changes things in the tenant only through workflow actions that you build, approve and publish. This page is for MSPs and IT teams deciding what to hand to SuperIT.
All three layers serve the same three ways SuperIT works (see How SuperIT works):
- Copilot for engineers: engineers ask SuperIT about a user's account, licences or mailbox while they work a ticket, and ask it to run Microsoft 365 actions.
- Self-service for end users: end users ask SuperIT for things like a password reset, and SuperIT runs a published action if the action's authorization policy allows it.
- Level 0 agent (ticket automation): when SuperIT investigates incoming tickets on its own, it can check Microsoft 365 as part of the investigation and recommend an action.
Layer 1: Sync users and groups
When you connect Microsoft 365 on a team, SuperIT regularly syncs the tenant's users, their licences, and their group membership. You use the sync to:
- Import users. Add staff to SuperIT with Add from MS365, and filter to Licensed users only. See Add users from Microsoft 365 or your PSA.
- Tag users by group. Each linked user's Microsoft 365 groups become read-only
m365:<group-name>tags on their team membership. - Recognise users on their devices. SuperIT matches Windows sign-ins on devices that run the SuperIT RMM agent to Microsoft 365 accounts, so it knows which person is on which device. See Recognising users on their devices.
The sync is read-only. It doesn't change anything in Microsoft 365.
Layer 2: Read and investigate with Microsoft Graph
With a Microsoft 365 connection, SuperIT can read the tenant through Microsoft Graph. It uses the connection's read-only application permissions, so it needs no extra setup and no approval. It can only read; it never sends a change to Microsoft 365 this way.
What engineers can ask about
| Area | What SuperIT can check | Example question |
|---|---|---|
| User accounts | Whether an account exists, is enabled, and its profile: job title, department, office, mail address, manager | "Is [email protected]'s account enabled? Who is her manager?" |
| Licences | Which licences a user has, and how many licences the tenant has bought and assigned | "Which licences does Tom have?" / "How many Business Premium licences are free?" |
| Groups | Which groups a user is in, who is in a group, group type (security, Microsoft 365, mail-enabled) | "Which groups is Priya in?" / "Who is in the Finance team group?" |
| Mailbox settings | Automatic replies, time zone, language and other mailbox settings | "Is Jane's out-of-office on, and what does it say?" |
| Inbox rules | A user's inbox rules, including rules that forward, redirect or delete mail | "Does Sam have any inbox rules that forward mail outside the company?" |
| Directory roles | Who holds an admin role, and which roles a user holds | "Who are the Global Administrators in this tenant?" |
| Entra ID devices | Devices registered or joined in Entra ID, their owners and status | "Is Jane's laptop registered in Entra ID?" |
| SharePoint | SharePoint sites in the tenant | "What's the address of the Finance SharePoint site?" |
| Service health | Current Microsoft 365 incidents and advisories | "Is there a Microsoft 365 outage affecting Exchange right now?" |
A typical security check: an engineer asks "Check Sam's mailbox for suspicious rules". SuperIT reads Sam's inbox rules, spots a rule that forwards every message to an outside address and marks it as read, and reports it with the rule's details. To remove the rule or block the account, the engineer runs a workflow action, such as Remove a suspicious inbox rule (see Layer 3).
SuperIT looks things up by name, email address or ID. Free-text searches across the whole directory, such as "everyone whose name contains 'smith'", may not work.
Who can use it
- Engineers and admins in chat, in the SuperIT web app or in the Pod, on teams that have a Microsoft 365 connection. SuperIT reads the tenant connected to the team the chat belongs to.
- Ticket investigations. When ticket automation investigates a ticket, SuperIT can make a few Microsoft Graph reads per ticket and include what it finds in its summary.
- End users can't. In an end-user chat, SuperIT doesn't read Microsoft Graph.
Not supported today
SuperIT can't read these through the Microsoft 365 connection:
- Sign-in logs and audit logs, including last sign-in time.
- MFA and authentication methods.
- Email content: messages, attachments, senders or delivery traces. Mailbox settings and inbox rules are readable; messages are not.
- Intune device management (compliance, configuration, apps).
- Microsoft Defender alerts and incidents.
- Conditional Access policies.
- Usage reports and Planner.
Some of these can be done with a workflow action and a Microsoft Graph credential that has the right scope. For example, Find inactive Microsoft 365 accounts reads sign-in activity that way.
Layer 3: Change things with workflow actions
SuperIT doesn't change Microsoft 365 through the connection. Every change goes through a workflow action: a short PowerShell script that runs in SuperIT's cloud sandbox with a delegated Microsoft Graph credential. You decide who can run each action and who must approve it with an authorization policy. Once an action is published, engineers, and end users if the policy allows, can ask SuperIT to run it in chat.
No Microsoft 365 actions ship with SuperIT today. Each guide below shows how to build one, usually by asking SuperIT to draft it. See Automate Microsoft 365 with workflows to set up the credential.
Common Microsoft 365 tasks
| Task | How | Guide |
|---|---|---|
| Check a user's account, licences, groups or mailbox settings | Ask SuperIT (read) | None needed |
| Check for suspicious inbox rules | Ask SuperIT (read) | None needed |
| Remove a suspicious inbox rule | Workflow action (Exchange Online) | Remove a suspicious inbox rule |
| Check Microsoft 365 service health | Ask SuperIT (read) | None needed |
| Create a user for a new starter | Workflow action (Graph) | Onboard a Microsoft 365 user |
| Offboard a leaver | Workflow action (Graph) | Offboard a Microsoft 365 user |
| Reset a password | Workflow action (Graph) | Reset a Microsoft 365 password |
| Block or unblock sign-in | Workflow action (Graph) | Block or unblock sign-in |
| Lock down a compromised account | Workflow action (Graph) | Revoke sessions for a compromised account |
| Assign or remove a licence | Workflow action (Graph) | Assign or remove a licence |
| Add or remove a group member | Workflow action (Graph) | Add or remove group members |
| Copy groups from another user | Workflow action (Graph) | Copy group memberships from another user |
| Set an out-of-office reply | Workflow action (Exchange Online) | Set an out-of-office reply |
| Forward a user's mail | Workflow action (Exchange Online) | Set up mail forwarding |
| Grant access to a shared mailbox | Workflow action (Exchange Online) | Grant shared mailbox access |
| Issue a Temporary Access Pass or reset MFA | Workflow action (Graph) | Reset MFA or issue a Temporary Access Pass |
| Report licence usage | Ask SuperIT (read). For a report emailed on a schedule, a workflow action (Graph) | Send a weekly summary report |
| Find inactive accounts | Workflow action (Graph, needs sign-in activity) | Find inactive Microsoft 365 accounts |
What SuperIT does not do in Microsoft 365
- It never changes Microsoft 365 through the connection. Changes happen only through workflow actions you publish.
- It doesn't manage Intune, Defender or Conditional Access.
- It doesn't connect more than one tenant per team. MSPs connect each customer's tenant on that customer's managed team.
- It doesn't read email content.