Microsoft 365

Hal connects to each customer’s Microsoft 365 tenant via a per-tenant Azure app registration with 15 standard, read-only application permissions. Onboarding takes about an hour for the first tenant.

What Hal reads:

Unified Audit Log (sign-in events, mailbox access, file access, policy changes, DLP, service health)
Directory and identity state (users, groups, roles, conditional access)
Risk detections and sign-in logs (with the right Entra ID licensing)

For setup: any of the three onboarding methods works — Hal-assisted (recommended, chat-driven), script, or manual.