Microsoft

Microsoft services integrate with SURF in several independent ways. This page covers OneDrive as remote storage for downloads, Microsoft Purview sensitivity labels, and Microsoft Teams alerting.

OneDrive

Routes user downloads into a corporate OneDrive account rather than the local device.

Step 1: Register the application in Azure

1. Go to https://portal.azure.com/ and sign in.
2. Register a client application in Microsoft Entra ID. Note its Application (client) ID, which is the first value SURF needs.
3. Go to Authentication → Add a platform → Web and add the redirect URI http://localhost:53682/
4. Go to API permissions and add the Microsoft Graph permissions required for file access, including Files.ReadWrite.All, Sites.FullControl.All and Application.ReadWrite.All. Grant admin consent for each.
5. Go to Certificates & secrets and create a new client secret. Copy the Value immediately.

Step 2: Find your OneDrive domain

1. Log in to your OneDrive account and go to My files.
2. Read the domain from the browser URL. It follows the pattern yourcompany-my.sharepoint.com

Step 3: Configure SURF

1. In SURF Admin, go to Settings → Integrations.
2. Click the gear icon and add OneDrive.
3. Enter the Client ID, Client Secret and Domain, then click Submit.
4. Go to Policies, enable Download Management, and toggle Remote Storage on.

Verify

Start a download in the SURF browser. You are taken to the Microsoft sign-in page. After signing in, a confirmation appears, and the downloaded file lands in My files on OneDrive.

Microsoft Purview

Reads published sensitivity labels from Microsoft Purview, previously called Microsoft Information Protection (MIP), so SURF policies can act on them.

1. In the Azure portal, register an application and collect its client ID, client secret and tenant ID.
2. Go to API permissions → Add a permission → Microsoft Graph → Application permissions.
3. Search for InformationProtectionPolicy and select InformationProtectionPolicy.Read.All, which reads all published labels and label policies for the organisation. Click Add permission.
4. Grant admin consent for the tenant. The permission should show as granted.
5. In SURF Admin, open the Microsoft Purview Information integration setup and enter the Client ID, Client Secret and Tenant ID under Credentials, then Submit.
6. Create labels under your company account at https://compliance.microsoft.com/informationprotection/labels. They then appear under the Labels tab of the integration.

Microsoft Teams

Sends change logs and alerts from the SURF Admin console into a Teams channel using an incoming webhook.

Step 1: Create the Teams channel and webhook

1. Open Microsoft Teams and select Teams in the left menu.
2. Click + and choose Create channel. Select the team, give the channel a name and description, choose the channel type and click Create.
3. Select the new channel, click its icon and then the gear icon to Manage channel.
4. Scroll to the Connectors section and click Edit.
5. Find Incoming Webhook and click Configure.
6. Give the connector a name and click Create.
7. Copy the generated URL.

Step 2: Configure SURF

1. Log in to the SURF Admin console at https://admin.surf-admin.link/
2. Go to Integrations, search for MicrosoftTeams, click the gear icon and select Add Integration.
3. Paste the webhook URL into the Webhook URL fields for change logs, alerts, or both.
4. Turn the toggles on, submit the changes, and enable the integration.

Filtering

Use Edit advanced filters to narrow what is sent. By default all alerts go to Teams until rules are defined. For example, a rule of Policy is Download plus Restricted Resource contains a given URL sends only download alerts for that site.

Troubleshooting