Skip to main content
Find answers to the most common questions about setting up RAIDEN, understanding detections and cases, and managing your team. If your question isn’t covered here, contact support at [email protected].

​
Setup & Connection

Yes, this is expected. RAIDEN is in early access and Microsoft publisher verification is in progress. The warning does not indicate a security risk. Click Accept to continue with the consent flow.
RAIDEN connects to two separate Microsoft APIs — Microsoft Graph and the Office Management Activity API. Microsoft requires a separate consent screen for each. Both use the same Global Administrator account and the whole process takes under 30 seconds.
No. RAIDEN works at any Microsoft 365 licence tier. It uses the Office Management Activity API for audit log ingestion, which is available across all commercial M365 plans.
The most common causes are:
  • Audit logging not enabled — go to Microsoft Purview → Audit → Start recording user and admin activity
  • Insufficient privileges — the consenting account must be a Global Administrator
  • Second consent not completed — go to Settings → Connection and click Reconnect M365
If none of these apply, email [email protected] with your tenant slug and the error shown in Settings → Connection.
Check your junk or spam folder first — invite emails are occasionally filtered by corporate mail systems. If it’s not there, contact your RAIDEN onboarding contact to resend the invite.

​
Detections & Cases

Filter by Critical and High severity first. Work Cases, not individual alerts — the case report gives you the full picture with an AI-generated investigation summary. Individual alerts are the building blocks; cases are the investigations.
Mark the alert as False Positive and use the suppression options to prevent future alerts for the same IP, application, or user. RAIDEN will not fire that rule against that entity again.
Go to Settings → Connection to see the last poll time and event count. If no events have been ingested in the last 30 minutes, check the connection status. You can also email [email protected] if you suspect a connectivity issue.
RAIDEN starts polling immediately after the connection is verified. The first poll processes the last 24 hours of audit logs. Findings typically appear within 5–10 minutes depending on your tenant activity level. After that, identity events (sign-ins, MFA, OAuth consent) are polled on a fast cadence — roughly every 2 minutes — so attacks like adversary-in-the-middle and token theft surface quickly.
Yes, if you opt in. By default RAIDEN investigates and recommends but never takes a write action on its own. From Settings → Automation you can enable automated response, after which RAIDEN will automatically revoke sessions and remove malicious inbox rules on cases it confirms as high-confidence real threats. Automatically disabling an account is a separate opt-in toggle. Everything RAIDEN can do automatically is also available as a manual one-click action, and you can turn automation off at any time. See Response Actions.

​
Team & Access

​
Still need help?

Email [email protected] with your organisation name or tenant slug and a brief description of the issue. For active compromise situations, include URGENT in the subject line to ensure your request is prioritised.