SaaS Application Integrations

Key SaaS threats: compromised user accounts (phishing, credential stuffing), insider data exfiltration (mass download, external sharing), OAuth app abuse (illicit consent grant), business email compromise (mailbox forwarding rules), and SaaS misconfiguration (public sharing, excessive permissions).

Yes. ManySignal has native connectors for both — M365 via the Unified Audit Log and Graph API, Google Workspace via the Admin SDK Audit API. Detections are equivalent across both platforms.

Email forwarding rule creation to external domains is the highest-priority single event. Other critical events: new OAuth app consent, admin role assignment, mailbox access by non-owner, and bulk email access via Graph API.

Yes. ManySignal ingests Salesforce EventLogFile data including Report export events. Alerts fire when a user exports more than a configured record count, when export activity occurs from a new IP, or when export patterns deviate from the user's baseline.

Yes. Box and Dropbox audit logs capture file access, download, and sharing events. ManySignal detects mass download events, sharing with external parties, and access from unexpected locations.

ManySignal monitors OAuth consent events in Microsoft 365 and Google Workspace. New apps requesting high-privilege scopes (Mail.Read, Files.ReadWrite) trigger alerts. A periodic audit of all consented OAuth apps is surfaced in the ManySignal risk dashboard.

Yes. ManySignal correlates authentication anomalies (new country, new device, MFA bypass) with subsequent suspicious activity (bulk download, sharing changes, admin actions) to detect and automatically respond to compromised SaaS accounts.

Google Workspace Audit API access is included in Business Starter and above. Admin SDK access for all event types requires Business Standard or above. ManySignal works with all editions that provide API access.

Notion audit events (page creation, sharing changes, member additions) are ingested. ManySignal alerts when internal pages are shared externally, when guest user counts increase significantly, or when bulk page export occurs.

ManySignal detects mass download events, external sharing changes, and abnormal activity patterns that match departing employee data theft behaviour — automatically correlating HR system deprovisioning events with SaaS activity spikes in the preceding days.