> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raidenhq.com/llms.txt
> Use this file to discover all available pages before exploring further.

# RAIDEN frequently asked questions: setup and detections

> Answers to common questions about connecting Microsoft 365, understanding detections, managing team access, and getting help from RAIDEN support.

Find answers to the most common questions about setting up RAIDEN, understanding detections and cases, and managing your team. If your question isn't covered here, contact support at [support@raidenhq.com](mailto:support@raidenhq.com).

## Setup & Connection

<AccordionGroup>
  <Accordion title="I received an 'Unverified publisher' warning from Microsoft. Is this safe?">
    Yes, this is expected. RAIDEN is in early access and Microsoft publisher verification is in progress. The warning does not indicate a security risk. Click **Accept** to continue with the consent flow.
  </Accordion>

  <Accordion title="Why am I asked to sign in to Microsoft twice?">
    RAIDEN connects to two separate Microsoft APIs — Microsoft Graph and the Office Management Activity API. Microsoft requires a separate consent screen for each. Both use the same Global Administrator account and the whole process takes under 30 seconds.
  </Accordion>

  <Accordion title="Do I need an E5 licence to use RAIDEN?">
    No. RAIDEN works at any Microsoft 365 licence tier. It uses the Office Management Activity API for audit log ingestion, which is available across all commercial M365 plans.
  </Accordion>

  <Accordion title="The connection test failed. What do I do?">
    The most common causes are:

    * **Audit logging not enabled** — go to Microsoft Purview → Audit → Start recording user and admin activity
    * **Insufficient privileges** — the consenting account must be a Global Administrator
    * **Second consent not completed** — go to Settings → Connection and click **Reconnect M365**

    If none of these apply, email [support@raidenhq.com](mailto:support@raidenhq.com) with your tenant slug and the error shown in Settings → Connection.
  </Accordion>

  <Accordion title="I didn't receive my invite email. What should I do?">
    Check your **junk or spam folder** first — invite emails are occasionally filtered by corporate mail systems. If it's not there, contact your RAIDEN onboarding contact to resend the invite.
  </Accordion>
</AccordionGroup>

***

## Detections & Cases

<AccordionGroup>
  <Accordion title="I'm seeing a lot of alerts. Where do I start?">
    Filter by **Critical** and **High** severity first. Work **Cases**, not individual alerts — the case report gives you the full picture with an AI-generated investigation summary. Individual alerts are the building blocks; cases are the investigations.
  </Accordion>

  <Accordion title="An alert fired on a known-safe IP or application. What do I do?">
    Mark the alert as **False Positive** and use the suppression options to prevent future alerts for the same IP, application, or user. RAIDEN will not fire that rule against that entity again.
  </Accordion>

  <Accordion title="How do I know RAIDEN is actively monitoring?">
    Go to **Settings → Connection** to see the last poll time and event count. If no events have been ingested in the last 30 minutes, check the connection status. You can also email [support@raidenhq.com](mailto:support@raidenhq.com) if you suspect a connectivity issue.
  </Accordion>

  <Accordion title="How quickly will I see detections after connecting?">
    RAIDEN starts polling immediately after the connection is verified. The first poll processes the last 24 hours of audit logs. Findings typically appear within 5–10 minutes depending on your tenant activity level. After that, identity events (sign-ins, MFA, OAuth consent) are polled on a fast cadence — roughly every 2 minutes — so attacks like adversary-in-the-middle and token theft surface quickly.
  </Accordion>

  <Accordion title="Can RAIDEN respond to threats automatically?">
    Yes, if you opt in. By default RAIDEN investigates and recommends but never takes a write action on its own. From **Settings → Automation** you can enable **automated response**, after which RAIDEN will automatically revoke sessions and remove malicious inbox rules on cases it confirms as high-confidence real threats. Automatically disabling an account is a separate opt-in toggle. Everything RAIDEN can do automatically is also available as a manual one-click action, and you can turn automation off at any time. See [Response Actions](/response-actions#automated-response-opt-in).
  </Accordion>
</AccordionGroup>

***

## Team & Access

<AccordionGroup>
  <Accordion title="What roles are available?">
    | Role        | What they can do                                                           |
    | ----------- | -------------------------------------------------------------------------- |
    | **Owner**   | Full access — team management, M365 connection, all settings               |
    | **Admin**   | Full access except owner-only settings — can invite users and change roles |
    | **Analyst** | View and action cases and alerts, mark false positives, export reports     |
    | **Viewer**  | Read-only access to cases and alerts                                       |
  </Accordion>

  <Accordion title="How long are invite links valid?">
    Invite links are valid for **7 days** from the time they are generated. If a link expires, an Owner or Admin can generate a new one from Settings → Team.
  </Accordion>
</AccordionGroup>

***

## Still need help?

Email [support@raidenhq.com](mailto:support@raidenhq.com) with your organisation name or tenant slug and a brief description of the issue. For active compromise situations, include **URGENT** in the subject line to ensure your request is prioritised.