Integrations

🔐 Sign in with Microsoft Entra ID (SSO)

Your team signs in with the corporate account they already use. Atalaya creates no users and no passwords: identity stays governed by your tenant, with your conditional access and your MFA. Offboard someone in Microsoft 365 and they lose access to Atalaya without anyone having to remember.

1. We register your organisation and send you an activation code.
2. Your IT lead signs in with their Microsoft account and enters the code: your tenant is linked and they become the account holder.
3. Everyone else signs in with no code, using their usual account, until the contracted seats are filled.
4. From your organisation panel you control who holds each seat and can release them when someone changes role or leaves.

The first time, Microsoft may ask a global administrator to approve the application: that is standard behaviour for any third-party app and takes two minutes. Atalaya only requests the basic profile of whoever signs in.

📨 Outlook add-in (optional)

An optional add-in puts an «Analyse with Atalaya» button inside Outlook (desktop and web): open an email, click, and see the verdict without leaving your mailbox. Everyone signs in with their own Microsoft account —no keys to hand out— and each analysis counts against their own seat. It does not replace the web app or the API: it is added convenience. It only reads the message (ReadItem permission); it never writes to your mailbox.

1. For the whole company: Microsoft 365 admin centre → Settings → Integrated apps → upload the manifest (/addin/manifest.xml). To try it yourself: Outlook → Get Add-ins → My add-ins → «Add from URL».
2. Open any email → Home tab → «Analyse with Atalaya» button.
3. First time, «Sign in with Microsoft»: your organisation's window opens, you sign in with your usual account and the pane stays connected for the working day.
4. Click «Analyse this email»: Atalaya checks sender, headers (SPF/DKIM if present), links and attachments, and shows a verdict + verifiable report.

The pane session lasts 12 hours and is renewed by signing in again; no password is ever stored. If someone loses access in Microsoft 365 or their seat is released, the pane stops analysing without waiting for anything to expire. An API key option remains for self-hosted installs and programmatic use. Distribution via the admin centre or sideload; AppSource publishing when there is demand.

🔔 Microsoft Teams alerts

When an analysis returns a critical verdict, Atalaya can post a card to a Teams channel. Since Microsoft is retiring the «Incoming Webhook» connectors, we use the modern method: a Power Automate (Workflows) flow.

1. In the Teams channel → … → «Workflows» → template «Post to a channel when a webhook request is received».
2. Power Automate generates an HTTPS URL. Copy it.
3. Hand it to the Atalaya operator to configure it for your account (PHISH_USER_WEBHOOKS variable).
4. Done: SUSPICIOUS/PHISHING verdicts get an Adaptive Card with type, score, target and summary.

We also support the legacy connector (webhook.office.com → MessageCard), Slack and Discord. Format detection is automatic from the URL.

⚙️ Power Automate

Atalaya exposes a REST API you can call from any Power Automate flow (the «HTTP» action or a custom connector).

1. Authentication: X-API-Key header with your key (issued by the operator).
2. Endpoints: POST /api/analyze-url (links), POST /api/analyze (email .eml/.msg), POST /api/analyze-qr (image/PDF with QR).
3. Custom connector: import the OpenAPI from /openapi.json to get typed actions in the flow designer.
4. Typical case: a flow that, on a reported email, calls Atalaya and opens a ticket if the score exceeds your threshold.

🗺️ On the roadmap

• Google Workspace sign-in (Microsoft Entra ID is already available).
• Verdict ingestion into Microsoft Sentinel and submission to Defender.