Petra Security: Microsoft 365 identity posture and account compromises

Petra Security is identity threat detection for Microsoft 365, built for MSPs. It watches a partner's Microsoft 365 audit trail for one thing: a real account compromise, an attacker actually inside somebody's mailbox. Around that it assesses 31 controls in how that Microsoft 365 is configured, scores the result out of 100, and counts the sign-in attacks that were tried and failed. This connector reads all three onto the matching Current company, so they reach the company record, your business reviews, your roadmaps and the company alert band. Current reads Petra and can never change anything in it.

A Petra API key belongs to the whole Petra organization, which is your MSP, so one key reaches every tenant you manage and there is nothing to paste per tenant. Petra has no read-only scope on a key, because a key inherits the organization rather than a role. That is why Current's read-only guarantee comes from the API having no write address rather than from a narrower key: there is no narrower key to ask for.

1. 1
   1 · Sign in at app.petrasecurity.com as an Admin

   Petra's Admin role is the only one that can create or delete an API key. A Full Member can open the key list and see that keys exist, but never sees a value and gets no Create button; the Sales and External Guest roles cannot reach the page at all. So a missing Create button is your role, not a fault. Ask a Petra Admin to make the key.
2. 2
   2 · Open Settings, then API Keys

   The page lists the keys the organization already has. Nothing here is per tenant.
3. 3
   3 · Press Create API Key

   Describe it with something a colleague will recognise, such as Current, so a future admin can tell which key belongs to what.
4. 4
   4 · Copy the key now

   Petra shows the full value once and can never show it again. If the page closes before you copy it, delete that key and create another. Petra publishes no expiry on a key, so it keeps working until somebody deletes it, and a deletion takes effect at once.

1. 1
   Open the Petra Security card

   In Current's left menu open Integrations (it sits under Workspace, so Tenant Admins have the link) and find Petra Security in the Monitoring & security section.
2. 2
   Paste the key and press Test connection

   Paste it into API key. Current reads your tenant list to prove the key works, then stores it server-side only: the browser never sees it again, and it is never written into a web address, a status message or a log. There is nothing else to fill in, because Petra has one global address with no regions, so the class of bug where a wrong region reads as a bad key cannot happen here. Current does not check the petra_ prefix either: a prefix Petra changed later would turn every new key into "invalid" with no way for an admin to tell why, so Petra's own answer is the only judge of a key.
3. 3
   Map Petra tenants to your companies

   The first sync reads your tenant list before anything else, so the mapping panel fills straight away. Each Petra tenant is one end-customer. Current matches on the normalized company name (lowercased, with punctuation and Inc/LLC/Ltd-style suffixes stripped) and links it when exactly one company matches; a name that fits two waits on the Unmapped tab for you to decide rather than being paired on a guess. Mapping one by hand attaches its posture, compromises and attacks right away instead of waiting for the next six-hourly sync. The Petra tenant id is the one in the dashboard address (app.petrasecurity.com/tenant/…), so an unmapped row is one click to check. Petra also sends each tenant's Microsoft 365 directory id, which Current stores but does not match on, because a workspace that has not connected Microsoft 365 would have nothing to match it against.

Petra syncs every 6 hours on a schedule, plus whenever a Tenant Admin presses Sync now on the card. Each run reads your tenants, then the licensing figures, then the account compromises, then the posture reports, then the failed attacks for a share of your tenants. Petra allows 10 requests a minute on each address, which is the tightest allowance of any connector in Current, so runs are paced under it and Sync now waits 10 minutes after the last run. The message says how many minutes are left.

The failed-attack read is the only one that asks per tenant, so each run takes a batch of them oldest-first and the next run continues where it stopped; every tenant comes round inside a week, and the window it reads is a rolling 30 days. The first run reads back 180 days of account compromises, and after that each run re-reads the last 14 days, which picks up an incident whose clean-up has moved on since. Nothing removes an account compromise once Current has it: Petra's incidents address returns the newest 500 and offers no way to reach the 501st, so keeping every one Current has ever seen is what makes the history grow instead of shrink. If a first run meets that ceiling, the card names the date its history starts rather than printing a count over a window nobody can state.

Petra scores 31 controls, and each comes back secure, fixed, open, drifted, in progress or not assessed. Not assessed means Petra is missing a Microsoft permission for that control, not that the setting is wrong. The usual reason is age: a Microsoft 365 tenant authorised in Petra before 17 July 2026 predates the permission set the posture assessment needs. Petra can grant the missing permission from its own Posture reports page, and the next assessment scores the control. Until then Current keeps it out of both halves of every share it prints and gives it a tile of its own on the card, because counting a missing permission as a failure invents a problem the partner does not have. Petra's own score does the same.

Two more readings travel with it. Secure and fixed both count as met, open and drifted both count as not met, and a control Petra has not ranked for severity is unranked rather than low, so it never enters the critical or high counts. And a compromise Petra marked as a pen test or as a false positive is left out of every count, rather than being read as unremediated because it is not marked remediated.

• ＋The Petra card on the company record: the posture score with Petra's grade and which way it moved since the baseline, the four control counts (met, open, drifted and not assessed), the critical and high controls that are open with what Petra says the state is, the account compromises with how far the clean-up has got, the global administrators against the maximum Petra recommends with the strong-MFA share and its denominator, and the sign-in attacks that failed in the last 30 days with where they came from. The header says whether Petra is monitoring the company, has only scanned it, or has it paused.
• ＋The People posture on the company record, where the licensed identities and the global administrators sit beside the rest of the people signals. Petra counts global administrators specifically, so those numbers stay separate from a workspace-wide MFA figure from Duo: the same person in two denominators would make both meaningless.
• ＋A Strategic Business Review, in the security chapter: the score and its direction since the baseline, how many controls have been fixed since then, the critical ones still open by name, and the attacks the tenant absorbed. No compromised account, no administrator, no phishing subject and none of Petra's attack codenames reach a pack.
• ＋The company AI brief, as one line of counts with the control names and severities. The compromised account, the phishing subject and the most-targeted people are kept out of what the AI is given rather than filtered afterwards.
• ＋Roadmaps: every open or drifted control Petra rates critical or high arrives in the Suggested tray carrying its own rationale and the fix Petra wrote for it. A company Petra has only scanned, where the scan turned something up, arrives as a finding too.
• ＋A Microsoft 365 posture dashboard tile, averaging the score across the companies with a completed assessment. A company without one sits outside both halves, and the tile says how many it covers.
• ＋The company alert band: an account compromise that is still open, which turns critical while an attacker is still inside the account, and a control Petra rates critical that is open or has drifted.