Skip to main content

Microsoft Outlook Data Connector

Learn how to automatically ingest Microsoft 365 email into Torq to enable Auto Triage and trigger response workflows for email-borne threats.

Overview

The Microsoft Outlook Data Connector continuously ingests email from your Microsoft 365 / Exchange Online environment into Torq, routing structured email events to Auto Triage and workflows. Each email is parsed into an analysis-ready event, including internet message headers, SPF/DKIM/DMARC verdicts, body content, extracted URLs, hyperlinks with anchor text, and attachment metadata, with no custom parsing required.

Key benefits

The data connector handles ingestion, parsing, and deduplication out of the box, so your team can focus on response rather than pipeline maintenance.

  • Simplified setup: Configure ingestion through a guided UI, no webhook subscriptions, delta query logic, or per-mailbox trigger setup required.

  • Structured event output: Every email becomes a consistent JSON event with all security-relevant fields pre-parsed and ready for Auto Triage.

  • Polling: Microsoft Graph nextLink pagination fetches messages in pages, following each nextLink URL until all results in the cycle are retrieved.

  • Broad mailbox support: Individual and shared mailboxes are supported using the same permission configuration.

Event throughput

Microsoft Outlook data connector events are delivered to Torq through the Torq webhook. The webhook supports up to 1,500 incoming events per minute per Torq account. If this limit is exceeded, incoming events are automatically queued and retried to ensure no data is lost.

Common scenarios

Triage org-wide inbound email automatically

All inbound email across your Microsoft 365 organization flows into Torq via the connector. Auto Triage receives each email as a structured event and automatically assesses sender reputation, authentication failures, suspicious URLs, and malicious attachment hashes, classifying, escalating, or remediating at scale. Analysts only review what Auto Triage surfaces.

Detect phishing campaigns across the organization

Because the connector ingests email from all configured mailboxes, Auto Triage can correlate signals in real time. When the same malicious URL or attachment hash appears across multiple inboxes simultaneously, Auto Triage identifies the coordinated campaign and triggers bulk response (quarantine, block, and notify) before it spreads.

Detect BEC and impersonation at ingestion time

Every email event includes parsed internet message headers, Reply-To, Return-Path, Received chain, and SPF/DKIM/DMARC verdicts, alongside sender display name and address. Auto Triage consumes these fields to detect executive or vendor impersonation at the point of ingestion, with no additional enrichment calls required.

Prerequisites

Before setting up the Microsoft Outlook data connector, ensure the following:

  • Microsoft 365 subscription with Exchange Online enabled.

  • Microsoft Entra ID admin access to create an app registration and grant tenant-wide admin consent. A non-admin creating the app registration is not sufficient.

  • Target mailboxes must exist in the organization before the connector is created. Both individual and shared mailboxes are supported.

No additional licensing requirements; the connector works without Microsoft Entra ID P2 or other premium SKUs.

How to use

Create an app registration in Microsoft Entra ID

The connector authenticates using OAuth 2.0 with application-only permissions. You must register an application in Microsoft Entra ID and grant it the appropriate permissions before configuring the connector in Torq.

Navigate to App Registrations

  1. Go to the Azure Portal: Navigate to portal.azure.com.

  2. Open App Registrations: Go to Microsoft Entra ID > App Registrations and click New Registration.

Register the application

  1. Name the app: Enter a unique and meaningful name (e.g., Torq Entra Connector).

  2. Set account type: Select Accounts in this organizational directory only.

  3. Register: Click Register.

Save application details

After registering, copy and save:

  • Application (Client) ID

  • Directory (Tenant) ID

Create a client secret

  1. Go to Certificates & Secrets: Click New Client Secret.

  2. Configure the secret: Add a description (e.g., Torq Secret) and choose an expiration period.

  3. Save: Click Add and copy the secret Value immediately; it is shown only once and cannot be retrieved later.

Configure API permissions

  1. Add permissions: Go to API Permissions > Add a permission > Microsoft Graph > Application permissions and add the permissions listed in the table below.

  2. Grant admin consent: Click Grant admin consent for [Your Organization] and confirm. This step is mandatory; without it, the connector health check fails with an authorization error.

Permission

Type

Purpose

Mail.Read

Application

Reads email messages, attachments, and headers from configured mailboxes

User.Read.All

Application

Validates that configured mailbox addresses exist in the organization

Set up a data connector instance in Torq

  1. Open connector setup: Go to Build > Integrations > Triggers > Microsoft Outlook Data Connector and click Add Instance.

  2. Configure connection details:

    • Instance name: Enter a unique and meaningful name (e.g., Contoso-Outlook-SOC).

    • Tenant ID, Client ID, Client secret: Paste the values from the app registration.

    • Microsoft Graph Base URL: Use https://graph.microsoft.com/ (default). For Azure Government/FedRAMP, use https://graph.microsoft.us/.

  3. Add mailboxes: Enter up to 10 mailbox email addresses (UPNs), comma-separated. Shared mailboxes are supported.

  4. Add folders: Enter up to 10 folder names, comma-separated. Inbox is monitored by default; you can add up to 9 additional folders.
    Torq supports standard folders (e.g., Junk Email, Sent Items) and custom folders (e.g., Reported Phishing). Folder names must match exactly as they appear in Exchange Online.

  5. Select routing destination: Choose where ingested events will be sent:

    • Workflows

    • Auto Triage

  6. Save: Click Add to create the connector. Ingestion starts automatically.

Ingestion starts from the moment the connector is created. There is no backfill; historical emails are not ingested.

Troubleshooting

"Proceed without Inbox label?" dialog appears on save

Inbox is not included in your folder list.

  1. Go back: Click Back to return to the form and add Inbox.

  2. Proceed anyway: Click Proceed to save without it, only the remaining resolved folders will be polled.

"We couldn't resolve folders [folder names] for all users" dialog appears on save

One or more folder names could not be matched, likely due to a typo or a folder that doesn't exist in the mailbox. Folder names must match exactly as they appear in Exchange Online (e.g., Junk Email, not JunkEmail).

  1. Go back: Click Back to return to the form and correct the folder names.

  2. Proceed anyway: Click Proceed to save with only the successfully resolved folders. Unresolved folders will not be polled.

Both dialogs are warnings, not hard blocks. The data connector is created successfully either way.

FAQs

What happens if a monitored folder is deleted after setup?

The connector logs a warning and skips that folder for the current cycle. Other folders and mailboxes continue polling normally.

How is duplicate ingestion prevented?

Each message's Microsoft Graph Immutable ID is stored with a 14-day retention window. Messages already processed within that window are silently skipped, even if moved between folders.

What happens if the Graph API rate limit is hit?

The connector respects the Retry-After header and retries on the next polling cycle. No data is lost.

Does updating the connector lose polling progress?

No. Polling state is persisted per mailbox × folder combination and is preserved when you update the connector.

Related Articles
Did this answer your question?