Exchange365 Security Settings

Exchange365 connector requires two Azure App Registrations. One for calendar synchronization and one for sending e-mail.

Complete list of parameters can be found on Exchange365 Connector Parameters.

In case of problems try the steps outlined on the Troubleshooting page.

Azure App Registration for Calendar Integration

Open Azure App registration page on Azure: https://go.microsoft.com/fwlink/?linkid=2083908.

Do the following:

  1. Create a new App Registration

  2. Name it “Totalview Calendar Synchronization”

  3. Set Supported account types to Accounts in this organizational directory only (<Customer Name> only – Single tenant)

  4. Leave Redirect URI unchanged

  5. Press “Register”

  6. Go to the Overview tab for the new App registration and note down Directory (tenant) ID and Application (client) ID values

../../../_images/AppRegistrationOverviewTab.png

  1. Go the Certificates & secrets tab

  2. Press “+ New client secret”

  3. Set Expires to a value that you are comfortable with

  4. Press “Add”

  5. Note down the generated client secret Value (the Client Secret ID can be disgarded - it is not used.)

../../../_images/AppRegistrationCertificatesAndSecretsTab.png

  1. Go to API permissions tab

  2. Remove the auto-generated User.Read permission, if present

  3. Select “Add a permission”

  4. Select “Microsoft Graph”

  5. Set type of permission to Application permission

  6. Check Calendars.Read, Calendars.ReadWrite, User.Read.All

  7. Press “Add permissions”

  8. Press “Grant admin consent for <customer name>”. If you do not have permission to do this yourself, forward this task to the relevant person in your company

../../../_images/AppRegistrationApiPermissionsTab-1.png

If desired, permission can be further restricted to only specific Office365 user accounts. See Restrict Azure App Registration Calendar Access Permissions for guide on how to do this.

Azure App Registration for E-mail

Steps are the same as for calendar, except for the following:

  1. Use a different name for the App Registration - for example “Totalview E-Mail Sending”

  2. GraphAPI permission check should only include Email.Send

  3. Configure GraphAPI permissions as specified in Restrict Azure App Registration E-mail Permissions