[microsoft_exchange_online_message_trace] Add Agentless Deployment Support

[mohitjha-elastic]

Description

Add agentless support to the microsoft_exchange_online_message_trace.

Requirements

Following the established Phase I pattern, for each integration see the Onboarding Integration Guide.

1. Technical implementation

• Update integration manifest.yml to enable agentless deployment mode ()
• Update integration documentation with agentless deployment instructions
• Update changelog.md

Example reference: #13367

2. Performance documentation

• Test and document throughput in agentless (requires access to vendor environment and/or sample data)
• Document specific metrics for each integration. For example/where possible:
  • API response time: Average time for vendor API calls to complete
  • Events processed per minute: How many log entries/events the integration can handle
  • Error rates: Percentage of failed API calls or data processing errors
  • Container resource usage: CPU and memory consumption under typical load
  • Vendor-specific limits: Rate limiting thresholds and API quotas

Example documentation format: "Crowdstrike Falcon Intelligence: 200ms avg API response, 5,000 events/min, 0.1% error rate, 512MB RAM/0.5CPU, 1000 API calls/hour limit"

Dependencies

• Agentless infrastructure GA readiness (still in beta)
• Input compatibility: Currently agentless is optimized for httpjson and cel inputs
• UX enhancement: Add agentless deployment filter/toggle to integrations catalog page for better discoverability

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

tl;dr: This is a valid feature-gap request — microsoft_exchange_online_message_trace currently cannot declare agentless support (manifest format_version: "3.0.2"), and enabling it cleanly requires both manifest-spec upgrade and deployment-mode scoping for the existing cel + logfile inputs.

Recommendation

Proceed with implementation as an enhancement. The safest path is to upgrade the package manifest spec to a deployment-mode-capable version, then explicitly enable agentless at policy-template level while constraining inputs so cel is agentless-compatible and logfile remains default-only.

Findings

1. Current package is below deployment-mode support gate

   • packages/microsoft_exchange_online_message_trace/manifest.yml:1 → format_version: "3.0.2"
   • docs/extend/manifest-spec.md:661-664 removes policy_templates[].deployment_modes for versions < 3.1.4.

2. No deployment modes are currently declared in the policy template

   • packages/microsoft_exchange_online_message_trace/manifest.yml:24-31 defines policy_templates + inputs, but no deployment_modes block.

3. This package mixes Graph API (cel) and local-file (logfile) inputs in one template

   • packages/microsoft_exchange_online_message_trace/manifest.yml:29 (type: cel)
   • packages/microsoft_exchange_online_message_trace/manifest.yml:170 (type: logfile)
   • packages/microsoft_exchange_online_message_trace/data_stream/log/manifest.yml:41-52 logfile stream requires paths.

4. Manifest spec supports input-level mode scoping (important here)

   • docs/extend/manifest-spec.md:553-568 documents inputs[].deployment_modes and states if omitted the input is compatible with all deployment modes.
   • This means if policy-level agentless is enabled without input scoping, logfile may be exposed in agentless mode unintentionally.

5. Precedent exists in nearby Microsoft integrations

   • packages/microsoft_sentinel/manifest.yml:38-45 has policy-template deployment_modes with agentless metadata.
   • packages/microsoft_sentinel/changelog.yml:70-72 (“Add support for agentless deployment”, PR #12586).
   • packages/microsoft_defender_endpoint/manifest.yml:21-28 has policy-template deployment_modes with agentless metadata.
   • packages/microsoft_defender_endpoint/changelog.yml:183-185 (“Enable Agentless deployment”, PR #12901).

6. Related issue/PR lookup limitation in this workflow run

   • Attempts to read/search issue/PR content for #19202, #17973, and PR #17560 returned integrity-filtered responses in this environment, so I could not verify discussion details directly.

Verification

I validated the above with repository reads and targeted CLI checks:

$ grep -nE "format_version:|deployment_modes|type: (cel|logfile)" \
  packages/microsoft_exchange_online_message_trace/manifest.yml \
  packages/microsoft_exchange_online_message_trace/data_stream/log/manifest.yml \
  packages/microsoft_defender_endpoint/manifest.yml \
  packages/microsoft_sentinel/manifest.yml

packages/microsoft_exchange_online_message_trace/manifest.yml:1:format_version: "3.0.2"
packages/microsoft_exchange_online_message_trace/manifest.yml:29:      - type: cel
packages/microsoft_exchange_online_message_trace/manifest.yml:170:      - type: logfile
packages/microsoft_defender_endpoint/manifest.yml:1:format_version: "3.4.0"
packages/microsoft_defender_endpoint/manifest.yml:21:    deployment_modes:
packages/microsoft_defender_endpoint/manifest.yml:36:      - type: logfile
packages/microsoft_defender_endpoint/manifest.yml:39:      - type: cel
packages/microsoft_sentinel/manifest.yml:1:format_version: 3.3.2
packages/microsoft_sentinel/manifest.yml:38:    deployment_modes:
packages/microsoft_sentinel/manifest.yml:47:      - type: cel

$ grep -n "Add support for agentless deployment\|Enable Agentless deployment" \
  packages/microsoft_sentinel/changelog.yml \
  packages/microsoft_defender_endpoint/changelog.yml

packages/microsoft_sentinel/changelog.yml:70:    - description: Add support for agentless deployment.
packages/microsoft_defender_endpoint/changelog.yml:183:    - description: Enable Agentless deployment.

Detailed Action Plan

1. Upgrade manifest format for this package

   • File: packages/microsoft_exchange_online_message_trace/manifest.yml:1
   • Move from 3.0.2 to a version that supports deployment modes (minimum >=3.1.4; preferably align with current Microsoft package conventions).

2. Enable deployment modes on the policy template

   • File: packages/microsoft_exchange_online_message_trace/manifest.yml under policy_templates[0]
   • Add deployment_modes with:
     • default.enabled: true
     • agentless.enabled: true
     • organization/division/team metadata following existing Microsoft package precedent.

3. Scope inputs by deployment mode to avoid invalid agentless UX

   • File: same manifest, under each inputs[] item
   • For type: cel, set deployment_modes to include agentless.
   • For type: logfile, set deployment_modes to default only.
   • Rationale: logfile requires local file paths (data_stream/log/manifest.yml:47-52) and should not be offered in agentless.

4. Update user-facing docs

   • File: packages/microsoft_exchange_online_message_trace/docs/README.md
   • Clarify that agentless support applies to Graph API collection path and that logfile collection remains self-managed/default mode.

5. Version + changelog

   • Files: packages/microsoft_exchange_online_message_trace/manifest.yml and packages/microsoft_exchange_online_message_trace/changelog.yml
   • Add enhancement changelog entry for agentless deployment support.

6. Package validation pass

   • Run normal package validation/lint checks used in this repo to confirm manifest compatibility and policy template rendering.

Related Items

Type	Item	Relevance
Issue	#19202	Current feature request
Issue	#17973	Found by search as potentially related, but content was not readable in this workflow run
PR	#17560	Found by search as potentially related, but content was not readable in this workflow run
PR	#12586	Microsoft Sentinel: agentless support entry in changelog
PR	#12901	Microsoft Defender Endpoint: agentless support entry in changelog
File	packages/microsoft_exchange_online_message_trace/manifest.yml:1	Current format version blocks deployment_modes
File	docs/extend/manifest-spec.md:661-664	Spec gate for policy template deployment_modes
File	docs/extend/manifest-spec.md:553-568	Input-level deployment mode scoping support
File	packages/microsoft_exchange_online_message_trace/data_stream/log/manifest.yml:47-52	Logfile input depends on local paths

Note

🔒 Integrity filter blocked 6 items

The following items were blocked because they don't meet the GitHub integrity level.

• #19202 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [microsoft_exchange_online_message_trace] Add Agentless Deployment Support #19202 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #19202 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17973 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17560 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #17973 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: Issue Triage

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.