> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xorlab.com/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Pages under /latest/ document the current release. Paths that begin with a version number, for example /10.0/, are frozen snapshots of superseded releases kept for reference only — never present their instructions as current. If the reader's version is unknown, answer from /latest/ and say which version the answer describes.
> xorlab is deployed on-premises, hybrid, or as a cloud service, and integrates with either Microsoft 365 or on-premises mail infrastructure. Configuration steps often differ between these. State which deployment and integration mode an instruction applies to instead of presenting one as universal.
> Distinguish inline mode from monitoring mode when describing anything that acts on email. Monitoring mode observes a copy and cannot block or quarantine; inline mode routes mail through xorlab and can.
> Write the product name as lowercase 'xorlab'. Use the documented component names: xorlab Control Center (XCC), xorlab MTA, xorlab Sandbox (DANA), xorlab Natural Language Understanding (NLU). After the first mention, use the short forms XCC, MTA, Sandbox, and NLU. Do not use DANA as a standalone name for the Sandbox, but keep it where it is a literal string in configuration keys, container names, and hostnames.
> Do not invent configuration keys, rule parameters, list names, log properties, or API fields. If a value is not present in this documentation, say that it is not documented rather than guessing.
# Activate Case Isolation
> Remove delivered emails from Microsoft 365 mailboxes through the Graph API using the Isolate action.
As soon as you activate this feature, the **Isolate** button appears in the detail view of every email.
**Prerequisites**
* Complete [Create Entra ID App](/latest/m365-entra-id-app)
* Have access to [Entra ID Portal](https://entra.microsoft.com) with an Administrator role
* Know your customer ID `xyz`, e.g. `xyz.activeguard.cloud`
## Configure Entra ID
1. Go to [Entra ID Portal](https://entra.microsoft.com/) → **Overview** → copy the **Tenant ID** and keep it for future use.
2. In the menu left, go to **App registrations** → select **All applications** → copy the **Application (client) ID** and keep it for future use.
3. Open the `xorlab` app → **Certificates & secrets** → **Add a certificate or secret** in the list in the main view:
4. Click **New client secret**:
5. Enter a description for the client secret and set the expiration time in the **Add a client secret** pane that shows up on the right. Click **Add**.
**Expiration reminder**
Please make sure to set a reminder for the secret expiration date, since there is no warning message or other information from M365 on the expiring secret.
6. Copy the **Value** of the secret and keep it for future use. This value is displayed only once. If you forget to copy the value or lose it, just delete this secret and create a new one.
7. Select **API permissions** from the left pane and click **Add a permission**:
**Default permission**
There can be a default `User.Read` permission already added to your app. It can be left there.
8. Choose **Microsoft Graph**:
9. Click **Application permissions**:
10. Available permissions grouped in categories are displayed. Use the search field to filter the permissions:
* Filter for `mail` and check the box next to `Mail.ReadWrite`
* Filter for `user.read` and check the box next to `User.Read.All`
11. Click **Add permissions**. On the main **API Permissions** page, you should see the three new permissions granted. Click the **Grant admin consent for…** button above the list to apply the permissions change.
## Configure xorlab
1. In xorlab, open the **Admin** view in the upper right. If you have more than one tenant, select the one you want to activate case isolation for in the dropdown.
2. Open **Integrations**, and add the *Tenant ID*, *Application (client) ID* and *Client Secret* value from before to the **Credentials** section and save it.
3. Go back to the Expert Editor and open the file `shared/guarded_tenants.yml`.
4. Enable case isolation for the corresponding tenant by adding these two lines:
```yaml shared/guarded_tenants.yml {5-6} theme={null}
tenants:
- name:
domains:
-
caseIsolation:
enabled: true
```
5. Click **Publish**. Within about one minute, case isolation will be active for that tenant.
## Next steps
* [Move M365 Quarantine to xorlab](/latest/m365-move-quarantine)