docs / setup
// SETUP GUIDE

30-Second Setup

No MX changes. No DNS records. No client software. Grant API consent and configure your risk policy — that's it.

Prerequisites
→ Microsoft 365 Global Admin access — or — Google Workspace Super Admin access
→ IntegrityLayer MSP account (apply at /design-partner)
→ Authenticator app on a mobile device (for TOTP enrollment)
01 / MICROSOFT 365 (AZURE ENTERPRISE APP)
01
Register the Enterprise Application

Go to Azure Portal → Azure Active Directory → Enterprise Applications → New Application. Search for 'IntegrityLayer' in the gallery, or use 'Create your own application' and enter the App ID provided in your MSP dashboard.

02
Grant Admin Consent

Navigate to the app's API Permissions blade. Click 'Grant admin consent for [your tenant]'. This grants the required Graph API scopes across all mailboxes in the tenant. See /docs/api-scopes for the full permission list.

03
Generate Client Credentials

Under Certificates & Secrets, create a new client secret. Copy the Tenant ID and Client Secret — you'll paste these into the IntegrityLayer MSP Dashboard when adding this client.

04
Add Client in MSP Dashboard
# In IntegrityLayer dashboard
MSP Portal → Clients → Add Client → Microsoft 365
Paste: tenant_id, client_secret
Set: risk_threshold, fail_mode, mfa_type
05
Verify Deployment
# Send a test email
Subject: 'please wire $500 to routing number 021000021'
From: any mailbox in the tenant
Expected: Quarantine within 500ms, MFA challenge sent
02 / GOOGLE WORKSPACE (MARKETPLACE APP)
01
Install from Google Workspace Marketplace

Go to admin.google.com → Apps → Google Workspace Marketplace Apps → Search for 'IntegrityLayer'. Click Install and grant domain-wide installation.

02
Configure Pub/Sub Subscription

IntegrityLayer automatically registers a Gmail Push Notification subscription via the API. You'll see a confirmation in your MSP dashboard within 60 seconds of installation.

03
Add Client in MSP Dashboard
# In IntegrityLayer dashboard
MSP Portal → Clients → Add Client → Google Workspace
Paste: domain, service_account_key (JSON)
Set: risk_threshold, fail_mode, mfa_type
04
Verify Deployment
# Send a test email
Subject: 'change payroll routing number to 021000021'
From: any @yourdomain.com address
Expected: Quarantine within 500ms, MFA challenge sent
03 / FULL CONFIG REFERENCE (config.yml)
# IntegrityLayer per-client configuration
risk_threshold : 0.75 # 0.0–1.0 · default: 0.75
fail_mode : open # "open" | "closed" · default: open
mfa_type : totp # "totp" · default: totp
latency_budget_ms : 500 # intercept window · default: 500
intent_classes :
- WIRE_TRANSFER
- PAYROLL_CHANGE
- ROUTING_NUMBER
- EXECUTIVE_REQUEST
# add custom classes per client sector
custom_keywords : # per-client keyword boosting
- "attorney-client privilege" # legal firms
- "routing number" # financial