Configuring the Microsoft 365 integration for ATR

To configure the Microsoft 365 Integration to support remediation actions for Automated Threat Response, you must do the following in the Microsoft Entra Admin Center:

• Set up Permissions & API

• Create a Conditional Named Location & Conditional Access Policy

Once you have set up the permissions and conditional access policy, enable ATR for the product you're integrating in the Managed XDR dashboard:

• Setting up ATR for Barracuda Incident Response

• Setting up ATR for Barracuda Impersonation Protection

NOTE In hybrid environments, changes are not applied to on-premise systems.

Setting up Permissions & API in the Microsoft Entra Admin Center

Adjust your current Barracuda XDR Microsoft 365 application. The app registration must:

• Have the Grant admin consent command enabled.

• Have the show the following new permissions for the Graph API roles:

  • Policy.Read.All

  • Policy.ReadWrite.ConditionalAccess

  • User.ReadWrite.All

  • User.EnableDisableAccount.All

  • MailboxSettings.Read

  • MailboxSettings.ReadWrite

1. Sign in to the Microsoft Entra Admin Center as at least a Conditional Access Administrator.

2. Select the API Permission tab.

   Open

   

3. Click Add a permission and then select Microsoft Graph.

   Open

   

   
   The Request API Permissions page is displayed.

4. Click Microsoft Graph and select Application permissions (not delegated).

   Open

   

5. Add the following permissions:

   • Policy.Read.All

   • Policy.ReadWrite.ConditionalAccess

   • User.ReadWrite.All

   • User.EnableDisableAccount.All

   • MailboxSettings.ReadWrite

6. Click Add permissions to save the changes.

7. Ensure the Grant admin consent command is enabled.

8. Click Save.

Creating a Conditional Named Location & Conditional Access Policy

1. Sign in to the Microsoft Entra Admin Center as at least a Conditional Access Administrator.

2. Browse to Entra ID > Conditional Access > Manage > Named Locations.

   Open

   

3. Select + IP Ranges Location at the top of the screen.

   Open

   

   
   The New Location dialo opens.

4. In Name, type Barracuda_XDR_Email_ATR_Block_IP.
   NOTE The named location is case sensitive and must be named exactly as written above.

5. Enter an IP address.
   NOTE You can enter any IP address. While it is required, you can remove it after creating the name location.

6. Select Create.

7. Select the Conditional Access tab. Select Policies, then select the New Policy button at the top of the page.

   Open

   

8. Give your policy the name Barracuda_XDR_Policy_Blocked_IPs.
   Note: Use this policy name exactly, taking care to use the correct capitalization since the policy name is case sensitive and it must match the policy name you add to the Managed XDR Dashboard in to enable ATR for your email application.

9. Under Assignments, select Users or workload identities.

10. Under Include, select All users.

11. Under Exclude, select at least one administrative user in case of a "Break Glass" scenario.

12. Under Target resources > Resources, under Include, select All resources.
    NOTE This blocks access from the IP that has been detected as malicious during phishing attempts.

13. Under Access controls, in the Grant section, select Block access, then select Select.

14. In the Network section, select the newly Named Location and the following Conditional Access Policy Settings:

    • In Configure, select Yes.

    • In Include, select Selected network and locations (NONE).

    • In Network, select Barracuda_XDR_Email_ATR_Block_IP.

    • In Enable Policy, select On.

15. Click Create.