Identify the Account for Granting SSPM Access

Identify the Office 365 account that you will use to log in to Office 365 during onboarding.
SSPM will use this account to establish a connection to your Office 365 instance. After SSPM establishes the connection, it will perform an initial scan of your Office 365 instance, and will then run scans at regular intervals of approximately 30 minutes. For SSPM to run these scans, the administrator account that you use to establish the initial connection must remain available. For this reason, we recommend that you use a dedicated service account to grant SSPM access. If you delete the service account, the scans will fail and you will need to onboard Office 365 again.
Required Permissions:
To grant SSPM the access it needs to connect to your Office 365 instance and to perform configuration, risky user, and third-party plugin scans, the account must be assigned to all of the following roles:
Global Administrator
Security Administrator
User Administrator
Log out of all Microsoft accounts.
Logging out of all Microsoft accounts helps ensure that you log in under the correct account during the onboarding process. Some browsers can automatically log you in by using saved credentials. To ensure that the browser does not automatically log you in to the wrong account, you can turn off any automatic log-in option or clear your saved credentials. Alternatively, you can prevent the browser from using saved credentials by opening the Cloud Management Console in an incognito window.