> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# BlueApp for Office 365 Actions

The BlueApp for Office 365 provides a set of orchestration actions that you can use to integrate your BlueApp for Office 365 in your USM Anywhere environment. The following table lists the available actions from the BlueApp.

**Actions for the BlueApp for Office 365**

| Action                                              | Description                                                                          |
| --------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Scan Audit. General Events                          | Run this action to scan Audit.General content from events                            |
| Disable User Account from Event/Alarm/Investigation | Run this action to disable a user account from an event, alarm, or investigation     |
| Disable User Account from Rule                      | Run this action to disable a user account from a rule                                |
| Enable User Account                                 | Run this action to enable a user account from a rule, event, alarm, or investigation |

**To view information about these actions in USM Anywhere**

1. In USM Anywhere, go to **Data Sources > BlueApps**.
2. Click the **Available Apps** tab.
3. Search for the BlueApp, and then click the tile.
4. Click the **Actions** tab to display information for the supported actions.
5. Click the **History** tab to display information about the executed orchestration actions.

## Launch Actions from Alarms, Events, or Investigations

You can launch an action directly from alarms, events, or investigations. If you want to apply an action to similar events that occur in the future, you can also [create orchestration rules](/documentation/usm-anywhere/user-guide/rules-management/orchestration-rules-creation) directly from the action applied to an alarm, event, or investigation.

**To launch an BlueApp for Office 365 response action for an alarm, event, or investigation**

1. Go to **Activity > Alarms**, **Activity > Events**, or **Investigations**.
2. Click the alarm, event, or investigation to open the details.
3. Click **Select Action**.
4. In the Select Action dialog box, select **Run BlueApp for Office 365 Action**.
5. Select the app action and fill out the fields that are populated below.
6. Click **Run**.

   After USM Anywhere initiates the action for an alarm or event, it displays a confirmation dialog box.

   If you want to create a rule to apply the action to similar items that occur in the future, click **Create rule for similar investigations**, **Create rule for similar alarms**, or **Create rule for similar events** and [define the new rule](/documentation/usm-anywhere/alienapps-guide/office-365/rules-alienapp-office-365). If not, click **OK**.