> ## Documentation Index > Fetch the complete documentation index at: https://docs.msportal.ai/llms.txt > Use this file to discover all available pages before exploring further. # Configure Petra Security Integration > Connect Petra Security with an API key, match Petra tenants to companies, and review Microsoft 365 account compromises. Petra Security is in **Beta**. It is available to every tenant and shows a **Beta** badge in **Settings › Integrations › Directory**. If something does not match your Petra account, contact [support@msportal.ai](mailto:support@msportal.ai). Petra Security brings Microsoft 365 identity threats into MSPortal: account compromise incidents, failed sign-in attacks and each tenant's posture report score. This setup is for **MSP staff with integration management access**. MSPortal only reads from Petra. It never remediates incidents or changes anything in Petra or Microsoft 365. ## What the integration covers * **Covered:** account compromise incidents with their remediation status, dwell time and phishing email; failed sign-in attacks over each tenant's last 30 days; and each tenant's latest completed posture report. * **Not covered:** remediation actions, Petra alert rules, and Microsoft 365 data that Petra does not report. Paused Petra tenants keep their incidents in MSPortal but are not read for new incidents or failed attacks. ## Before you connect 1. Sign in to Petra as an Admin. Only Petra Admins can create keys. 2. Open **Settings › API Keys**, choose **Create API Key**, and copy the key immediately. Petra shows the full key only once. See [Petra's API authentication guide](https://docs.petrasecurity.com/docs/api-reference/authentication). ## Connect 1. Open **Settings › Integrations**, choose **Directory**, find **Petra Security**, and choose **Connect**. 2. Paste the key into **API Key**. Paste only the key, without the Bearer prefix. 3. Choose **Test connection**. A successful test shows your Petra organization and how many tenants it covers. 4. Choose **Save and continue**. MSPortal saves the key in the vault and starts the first sync. ## Match tenants to companies Open **Import or match companies** after the first sync. Each row is a Petra tenant, with its **Microsoft tenant ID**. A tenant whose Microsoft tenant ID matches a company's Microsoft 365 or CIPP connection is suggested at 100% confidence. Other tenants are suggested by name. Accept a suggestion, choose another company, or use **Import company** to create one. **Accept strong matches** accepts every suggestion at 90% confidence or more after you review them. **Ignore** hides a tenant that is not a client's, and you can restore it later. Incidents, failed attacks and posture appear only for matched tenants. ## Where the data appears * **Security › Identity Threats:** the summary shows **Open incidents**, **Live incidents (30 days)**, **Historical incidents**, **Failed sign-in attacks (30 days)** and **Average posture score**. **Incidents** lists each compromise with its **User**, **State**, **Company**, **Remediation**, **Detection**, **Dwell time** and **Phishing email**, and a link to open it in Petra. **Tenants** lists each tenant's open incidents, failed attacks, **Posture score** and **Grade**. Tenants is hidden when one company is selected. * **Security › Dashboard:** the **Open identity incidents** and **Failed sign-in attacks (30 days)** tiles, and the **Identity threats** card with open incidents by company. See [Read the Security Dashboard](/user-guides/security/read-dashboard). * **Reports:** add the **Petra Identity Threats** block. Account compromises follow the report period. **Open now** is today's count, failed sign-in attacks cover each tenant's last 30 days, and posture uses each tenant's latest report. * **AI reports:** security reports include Petra compromises for the period, split into live and historical, with open incidents, failed attacks and posture. * **MCP:** use `list_petra_incidents` and `get_petra_identity_summary`. Petra finds **Historical** incidents in past sign-in data when it onboards a tenant. They are counted apart from **Live** detections, so a historical incident is not a new attack. ## Sync and troubleshooting Petra syncs every 2 hours. Saving the connection starts a sync. Petra allows one failed-attack request a minute, so MSPortal refreshes failed sign-in attacks for each matched tenant about once a day, and large accounts take longer. * **Petra rejected this API key:** paste only the key, without the Bearer prefix, and check that it has not been deleted in Petra. * **No tenants to match:** wait for the first sync to finish. While none have synced, **Import or match companies** offers a button to sync tenants. * **A company has no data:** check its tenant match and the company selector. Paused Petra tenants are not read for new incidents or failed attacks. * **Failed attacks look older than incidents:** failed attacks refresh about once a day per tenant, while incidents refresh every 2 hours. To remove the connection, open **More actions** on the connection page and choose **Disconnect…**. This removes the stored key, the tenant matches and the data synced from Petra. It changes nothing in Petra; delete the key there when you no longer need it. ## Related guides * [Integration setup guides](/user-guides/integrations/index) * [Security](/user-guides/security/index) * [Read the Security Dashboard](/user-guides/security/read-dashboard) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.