diff --git a/local/o365/classes/form/cohortsync.php b/local/o365/classes/form/cohortsync.php
index 6cd28dd14..575797c6a 100644
--- a/local/o365/classes/form/cohortsync.php
+++ b/local/o365/classes/form/cohortsync.php
@@ -116,7 +116,7 @@ public function definition(): void {
 
                 $deletemappingurl = new url(
                     '/local/o365/cohortsync.php',
-                    ['action' => 'delete', 'connectionid' => $mapping->id]
+                    ['action' => 'delete', 'connectionid' => $mapping->id, 'sesskey' => sesskey()]
                 );
                 $existingmappingstable->data[] = [
                     $groupname,
diff --git a/local/o365/classes/page/acp.php b/local/o365/classes/page/acp.php
index 089650bdc..96dbfb8ce 100644
--- a/local/o365/classes/page/acp.php
+++ b/local/o365/classes/page/acp.php
@@ -378,6 +378,8 @@ public function mode_healthcheck() {
     public function mode_usermatchclear() {
         global $DB;
 
+        require_sesskey();
+
         $type = optional_param('type', null, PARAM_TEXT);
         switch ($type) {
             case 'success':
@@ -505,8 +507,8 @@ public function mode_usermatch() {
         if ($matchqueuelength > 0) {
             echo html_writer::start_tag('div', ['class' => 'local_o365_matchqueuetoolbar']);
 
-            $clearurl = new url('/local/o365/acp.php', ['mode' => 'usermatchclear']);
-            $clearurl = $clearurl->out();
+            $clearurl = new url('/local/o365/acp.php', ['mode' => 'usermatchclear', 'sesskey' => sesskey()]);
+            $clearurl = $clearurl->out(false);
 
             // Clear successful button.
             $checkicon = $OUTPUT->pix_icon('t/check', 'success', 'moodle');
@@ -1270,7 +1272,7 @@ public function mode_teamconnections() {
      * Update Teams cache.
      */
     public function mode_teamconnections_update_cache() {
-        confirm_sesskey();
+        require_sesskey();
 
         $graphclient = \local_o365\feature\coursesync\utils::get_graphclient();
         // Pass forceupdate=true so an explicit admin request is never silently skipped
@@ -1292,7 +1294,7 @@ public function mode_teamconnections_connect() {
         $this->set_title(get_string('acp_teamconnection', 'local_o365'));
 
         $courseid = required_param('course', PARAM_INT);
-        confirm_sesskey();
+        require_sesskey();
 
         $redirecturl = new url('/local/o365/acp.php', ['mode' => 'teamconnections']);
 
@@ -1431,7 +1433,7 @@ public function mode_teamconnections_update() {
         $this->set_title(get_string('acp_teamconnection', 'local_o365'));
 
         $courseid = required_param('course', PARAM_INT);
-        confirm_sesskey();
+        require_sesskey();
 
         $redirecturl = new url('/local/o365/acp.php', ['mode' => 'teamconnections']);
 
@@ -1572,6 +1574,8 @@ public function mode_teamconnections_update() {
     public function mode_maintenance_recreatedeletedgroups() {
         global $DB, $PAGE;
 
+        require_sesskey();
+
         $this->set_title(get_string('acp_maintenance_recreatedeletedgroups', 'local_o365'));
 
         $coursesenabled = \local_o365\feature\coursesync\utils::get_enabled_courses(true);
@@ -1664,6 +1668,8 @@ public function mode_maintenance_recreatedeletedgroups() {
     public function mode_maintenance_resyncgroupusers() {
         global $DB, $PAGE;
 
+        require_sesskey();
+
         $this->set_title(get_string('acp_maintenance_resyncgroupusers', 'local_o365'));
 
         $courseid = optional_param('courseid', 0, PARAM_INT);
@@ -1915,12 +1921,12 @@ public function mode_maintenance() {
         echo html_writer::empty_tag('br');
         echo html_writer::div(get_string('acp_maintenance_warning', 'local_o365'), 'alert alert-info');
 
-        $toolurl = new url($this->url, ['mode' => 'maintenance_resyncgroupusers']);
+        $toolurl = new url($this->url, ['mode' => 'maintenance_resyncgroupusers', 'sesskey' => sesskey()]);
         $toolname = get_string('acp_maintenance_resyncgroupusers', 'local_o365');
         echo html_writer::link($toolurl, $toolname, ['target' => '_blank']);
         echo html_writer::div(get_string('acp_maintenance_resyncgroupusers_desc', 'local_o365'));
 
-        $toolurl = new url($this->url, ['mode' => 'maintenance_recreatedeletedgroups']);
+        $toolurl = new url($this->url, ['mode' => 'maintenance_recreatedeletedgroups', 'sesskey' => sesskey()]);
         $toolname = get_string('acp_maintenance_recreatedeletedgroups', 'local_o365');
         echo html_writer::empty_tag('br');
         echo html_writer::link($toolurl, $toolname, ['target' => '_blank']);
@@ -1941,7 +1947,7 @@ public function mode_maintenance() {
         echo html_writer::div(get_string('cfg_cleanupoidctokens_desc', 'auth_oidc'));
 
         // Clear delta token.
-        $toolurl = new url($this->url, ['mode' => 'maintenance_cleandeltatoken']);
+        $toolurl = new url($this->url, ['mode' => 'maintenance_cleandeltatoken', 'sesskey' => sesskey()]);
         $toolname = get_string('acp_maintenance_cleandeltatoken', 'local_o365');
         echo html_writer::empty_tag('br');
         echo html_writer::link($toolurl, $toolname);
@@ -1956,6 +1962,8 @@ public function mode_maintenance() {
     public function mode_maintenance_cleandeltatoken() {
         global $PAGE;
 
+        require_sesskey();
+
         $this->set_title(get_string('acp_maintenance_cleandeltatoken', 'local_o365'));
 
         $existingtaskuserysnclastdeltatokensetting = get_config('local_o365', 'task_usersync_lastdeltatoken');
@@ -2017,7 +2025,7 @@ public function mode_userconnections() {
     public function mode_userconnections_resync(): bool {
         global $DB;
         $userid = required_param('userid', PARAM_INT);
-        confirm_sesskey();
+        require_sesskey();
 
         if (utils::is_connected() !== true) {
             mtrace('Microsoft 365 not configured');
@@ -2056,7 +2064,7 @@ public function mode_userconnections_manualmatch() {
         global $DB, $PAGE;
 
         $userid = required_param('userid', PARAM_INT);
-        confirm_sesskey();
+        require_sesskey();
 
         // Perform prechecks.
         $DB->get_record('user', ['id' => $userid], '*', MUST_EXIST);
@@ -2120,7 +2128,7 @@ public function mode_userconnections_unmatch() {
         global $DB, $PAGE;
 
         $userid = required_param('userid', PARAM_INT);
-        confirm_sesskey();
+        require_sesskey();
         $user = $DB->get_record('user', ['id' => $userid], '*', MUST_EXIST);
         $confirmed = optional_param('confirmed', 0, PARAM_INT);
         if (!empty($confirmed)) {
@@ -2151,7 +2159,7 @@ public function mode_userconnections_disconnect() {
 
         require_once($CFG->dirroot . '/auth/oidc/auth.php');
         $userid = required_param('userid', PARAM_INT);
-        confirm_sesskey();
+        require_sesskey();
         $user = $DB->get_record('user', ['id' => $userid], '*', MUST_EXIST);
         $confirmed = optional_param('confirmed', 0, PARAM_INT);
         if (!empty($confirmed)) {
diff --git a/local/o365/cohortsync.php b/local/o365/cohortsync.php
index de099d179..cae6ddbac 100644
--- a/local/o365/cohortsync.php
+++ b/local/o365/cohortsync.php
@@ -63,6 +63,7 @@
 
 $action = optional_param('action', '', PARAM_ALPHA);
 if ($action == 'delete') {
+    require_sesskey();
     $connectionid = required_param('connectionid', PARAM_INT);
     if (!$connectionrecord = $DB->get_record('local_o365_objects', ['id' => $connectionid])) {
         throw new moodle_exception('cohortsync_connectionnotfound', 'local_o365');