Skip to main content
Petra Security is in Beta. It is available to every tenant and shows a Beta badge in Settings › Integrations › Directory. If something does not match your Petra account, contact support@msportal.ai.
Petra Security brings Microsoft 365 identity threats into MSPortal: account compromise incidents, failed sign-in attacks and each tenant’s posture report score. This setup is for MSP staff with integration management access. MSPortal only reads from Petra. It never remediates incidents or changes anything in Petra or Microsoft 365.

​
What the integration covers

  • Covered: account compromise incidents with their remediation status, dwell time and phishing email; failed sign-in attacks over each tenant’s last 30 days; and each tenant’s latest completed posture report.
  • Not covered: remediation actions, Petra alert rules, and Microsoft 365 data that Petra does not report. Paused Petra tenants keep their incidents in MSPortal but are not read for new incidents or failed attacks.

​
Before you connect

  1. Sign in to Petra as an Admin. Only Petra Admins can create keys.
  2. Open Settings › API Keys, choose Create API Key, and copy the key immediately. Petra shows the full key only once.
See Petra’s API authentication guide.

​
Connect

  1. Open Settings › Integrations, choose Directory, find Petra Security, and choose Connect.
  2. Paste the key into API Key. Paste only the key, without the Bearer prefix.
  3. Choose Test connection. A successful test shows your Petra organization and how many tenants it covers.
  4. Choose Save and continue. MSPortal saves the key in the vault and starts the first sync.

​
Match tenants to companies

Open Import or match companies after the first sync. Each row is a Petra tenant, with its Microsoft tenant ID. A tenant whose Microsoft tenant ID matches a company’s Microsoft 365 or CIPP connection is suggested at 100% confidence. Other tenants are suggested by name. Accept a suggestion, choose another company, or use Import company to create one. Accept strong matches accepts every suggestion at 90% confidence or more after you review them. Ignore hides a tenant that is not a client’s, and you can restore it later. Incidents, failed attacks and posture appear only for matched tenants.

​
Where the data appears

  • Security › Identity Threats: the summary shows Open incidents, Live incidents (30 days), Historical incidents, Failed sign-in attacks (30 days) and Average posture score. Incidents lists each compromise with its User, State, Company, Remediation, Detection, Dwell time and Phishing email, and a link to open it in Petra. Tenants lists each tenant’s open incidents, failed attacks, Posture score and Grade. Tenants is hidden when one company is selected.
  • Security › Dashboard: the Open identity incidents and Failed sign-in attacks (30 days) tiles, and the Identity threats card with open incidents by company. See Read the Security Dashboard.
  • Reports: add the Petra Identity Threats block. Account compromises follow the report period. Open now is today’s count, failed sign-in attacks cover each tenant’s last 30 days, and posture uses each tenant’s latest report.
  • AI reports: security reports include Petra compromises for the period, split into live and historical, with open incidents, failed attacks and posture.
  • MCP: use list_petra_incidents and get_petra_identity_summary.
Petra finds Historical incidents in past sign-in data when it onboards a tenant. They are counted apart from Live detections, so a historical incident is not a new attack.

​
Sync and troubleshooting

Petra syncs every 2 hours. Saving the connection starts a sync. Petra allows one failed-attack request a minute, so MSPortal refreshes failed sign-in attacks for each matched tenant about once a day, and large accounts take longer.
  • Petra rejected this API key: paste only the key, without the Bearer prefix, and check that it has not been deleted in Petra.
  • No tenants to match: wait for the first sync to finish. While none have synced, Import or match companies offers a button to sync tenants.
  • A company has no data: check its tenant match and the company selector. Paused Petra tenants are not read for new incidents or failed attacks.
  • Failed attacks look older than incidents: failed attacks refresh about once a day per tenant, while incidents refresh every 2 hours.
To remove the connection, open More actions on the connection page and choose Disconnect…. This removes the stored key, the tenant matches and the data synced from Petra. It changes nothing in Petra; delete the key there when you no longer need it.