Microsoft 365

Microsoft 365 through Microsoft Graph: services that are degraded or interrupted, active incidents and advisories, licenses about to run out, and users flagged at risk.

DumbMonit signs in as an Entra application (client credentials flow): it exchanges the application’s client ID and secret for a one-hour token at login.microsoftonline.com, keeps it until it expires, and reads graph.microsoft.com once a minute. Every call is a read; the application only holds read permissions.

This is an Internet API: the address of the device is the API’s (graph.microsoft.com), not a machine’s, and nothing in your network is contacted.

Validated against the vendor documentation only — not yet tested on a real system

This integration was built from the Microsoft Graph v1.0 documentation, not against a live tenant. It only reads. Tell us what breaks.

Network ports to open

From the DumbMonit server (or its relay agent) to the device:

Port	Protocol	Purpose
443	TCP	Microsoft Graph API (HTTPS, graph.microsoft.com)
443	TCP	Microsoft sign-in, token request (HTTPS, login.microsoftonline.com)

What it watches

All metrics are prefixed dumbmonit_m365_.

Metric	Labels	Meaning
service_ok	service	1 while the service reports a healthy state (operational, restored, resolved, mitigated), 0 otherwise.
services, services_degraded		Services listed, and how many are not healthy.
incidents_active, advisories_active		Unresolved service issues, by classification.
service_issues	service, classification	Unresolved issues per service (incident or advisory).
license_used_percent	sku	Assigned units over purchased units, in percent.
license_consumed, license_enabled, license_available	sku	Assigned, purchased and remaining units.
licenses_exhausted		Number of paid licenses with every unit assigned.
risky_users, risky_users_high		Users at risk, and those at high risk.
signin_failures_1h		Failed sign-ins of the last hour (at most 100); only when risky users cannot be read.
issues_readable, licenses_readable, risky_readable, signins_readable		1 when that read was allowed, 0 when Microsoft refused it.

Free and trial licenses (Power BI free, Power Automate free, Windows Store…) and licenses with no purchased unit are ignored: their gauge means nothing.

Only the service health is mandatory. If your tenant has no Entra ID P2 license, the risky users read is refused: risky_readable is 0, DumbMonit counts the failed sign-ins of the last hour instead (Entra ID P1 and AuditLog.Read.All), and if that is refused too the probe still succeeds without any risk data.

The built-in rules that apply:

• Microsoft 365 service degraded: a service is degraded, interrupted or under investigation for 10 minutes (Advisory, reminded every 6 hours).
• Microsoft 365 licenses exhausted: every unit of a paid license is assigned (Advisory, reminded daily).
• Microsoft 365 licenses nearly full: more than 95 % of a paid license is assigned (Info, reminded weekly).
• Microsoft 365 users at risk: at least one user is flagged at risk (Advisory, reminded daily).

The monitor page

The Microsoft 365 panel says what is wrong in a sentence, shows the degraded services, the active incidents, the exhausted licenses and the users at risk, then lists the services with their state, the active incidents and the licenses with their usage.

Create a read-only Entra application for DumbMonit

1. In the Microsoft Entra admin center (entra.microsoft.com), open Entra ID → App registrations → New registration, name it DumbMonit, keep a single tenant and register it.

2. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.

3. Open API permissions → Add a permission → Microsoft Graph → Application permissions, add the permissions listed below, then click Grant admin consent.

4. Open Certificates & secrets → New client secret and copy its Value (not the Secret ID): it is shown once and it expires, so note the date.

5. In DumbMonit, enter graph.microsoft.com as address, paste the client ID and the secret value, and fill in the Tenant ID option.

Required permissions

Add them as application permissions (not delegated), then grant admin consent.

• ServiceHealth.Read.All — Reads the health of each service and its active incidents (required).
• LicenseAssignment.Read.All — Reads purchased and assigned license counts per SKU (optional).
• IdentityRiskyUser.Read.All — Reads users flagged at risk; needs Entra ID P2 (optional).
• AuditLog.Read.All — Counts failed sign-ins when risk data is unavailable; needs Entra ID P1 (optional).

Warning

Admin consent gives the application tenant-wide read access to the data above. Use a dedicated app registration with only these permissions, and renew its client secret before it expires.

Vendor documentation: https://learn.microsoft.com/en-us/graph/api/serviceannouncement-list-healthoverviews

Notes

The client secret expires (24 months at most). When it does, DumbMonit shows “Microsoft refused the application”: create a new secret and paste its value. Add the Microsoft Entra ID integration to be warned before that happens.

Credentials

Credential	Fields
Entra application	Application (client) ID and the client secret Value.

Address: graph.microsoft.com. Options:

• Tenant ID (required): the Directory (tenant) ID, a GUID, or a verified domain name.
• Sign-in URL: https://login.microsoftonline.com by default. Change it only for a sovereign cloud (for example https://login.microsoftonline.us, with graph.microsoft.us as address).
• Timeout per request (seconds) (15 s).

Troubleshooting

“Microsoft refused the application”: the client ID or the secret is wrong, or the secret expired. Copy the secret Value, not its ID.

“Microsoft knows no tenant”: the Tenant ID is wrong; copy the Directory (tenant) ID of the app registration.

“Microsoft Graph refused … (403): grant the application the ServiceHealth.Read.All application permission”: add it and click Grant admin consent; it can take a few minutes to apply.

risky_readable stays 0: the tenant has no Entra ID P2 license, or IdentityRiskyUser.Read.All was not granted. Nothing is broken.

No licenses listed: LicenseAssignment.Read.All is missing (licenses_readable is 0), or every license of the tenant is free.