Skip to main content
RAIDEN monitors individual Microsoft 365 users for suspicious activity. Users are added to your monitoring list automatically as they are detected, so there is no manual setup required to get started.

​
Automatic user detection

During early access, users are added automatically when RAIDEN identifies them during detection polling. As soon as your M365 tenant is connected and RAIDEN begins processing audit log events, any user whose activity appears in the logs is added to your monitored users list with default settings. This means:
  • No manual setup required — connect M365 and users appear automatically
  • New users are picked up on the next poll cycle — identity activity is polled on a fast cadence (roughly every 2 minutes)
  • Default risk level is Medium — you can adjust this per user at any time
  • Only active users are added — dormant accounts that generate no audit log activity will not appear until they become active
Coming soon — Bulk import of users and groups from your M365 directory, so you can pre-populate your user list before the first detection cycle.

​
Manually adding a user

You can also add users manually before they generate any activity. This is useful for pre-populating high-priority users (e.g. executives, Global Admins) so their profiles are ready when detections begin.
  1. Navigate to Users in the sidebar
  2. Click Add User in the top right
  3. Search for the user by name or email in the Search M365 Users field — this pulls directly from your connected M365 directory
  4. Select the user from the dropdown, or type their email manually
  5. Set the Risk Level — Low, Medium, High, or Critical
  6. Click Add User
The user will now appear in your monitored users list immediately.

​
User profile

Each monitored user has a profile showing: Click View Full Profile to see the complete user detail page, or View All Findings to jump to their detection history.

​
Removing a user

To stop monitoring a user:
  1. Go to Users
  2. Find the user in the list
  3. Click the trash icon on their row
  4. Confirm the removal
Removing a user does not delete their historical findings or cases — it only stops them from appearing in your monitored users list.
If a removed user generates new M365 activity, they will be automatically re-added on the next poll cycle. To permanently exclude a user, use suppression rules on the relevant detections instead.

​
Risk levels

You can assign a risk level to each user to help prioritise your monitoring. Risk levels are informational and do not affect detection sensitivity.