Microsoft Entra OAuth
Entra OAuth allows secure authentication to YOUR ARCHIVE using Microsoft account credentials including supporting Single Sign-on (SSO) and conditional access.
Quickstart: Register an app in the Microsoft identity platform - Microsoft identity platform
Create an App Registration in Entra
Log in to the Entra Portal using Global Admin credentials.
In the Entra Portal (entra.microsoft.com) go to Identity > Applications > App registrations > New Registration.
Provide the following details:
Name: "YOUR ARCHIVE."
Supported Account Types: Choose Accounts in this organizational directory only.
Redirect URI: Use the URI provided by YOUR ARCHIVE (
Advanced Configuration -> SSO-OAuth -> Create Connection) and select Web in the dropdown.
Get Client ID and Client Secret: Copy the Application (client) ID.
Enter it into the YOUR ARCHIVE Connector's Client ID field.
Go to
Certificates & Secretsand create a new client secret. Name it "YOUR ARCHIVE" and set the expiry to 24 months.
Copy the value to the Client Secret field in YOUR ARCHIVE.
Important: Do not refresh the Azure page before copying the secret.
Configure API permissions:
After registration, go to API Permissions > Add Permission.
Microsoft Graph > Delegated permissions. Add the permissions in the table below.
Grant admin consent for the permissions.
Token and Authorization URLs:
Use the Tenant ID to replace the "Common" placeholder in the URLs.
Save the OAuth configuration in both Azure AD and YOUR ARCHIVE. Test SSO login using Office 365 credentials.
API Permissions
Microsoft Graph
Delegated
View users' email address
files.readwrite
Microsoft Graph
Delegated
Have full access to user files
mail.read
Microsoft Graph
Delegated
Read user mail
User Mailbox Access for Mailbox Reader or Folder Replication
mail.readwrite
Microsoft Graph
App
Read and write mail in all mailboxes
Restore to Mailbox, Mailbox Reader, Folder Replication
mail.send
Microsoft Graph
App
Send mail as any user
Mailbox Reader, Folder Replication, Reply/Compose/Forward
mailboxsettings.read
Microsoft Graph
Delegated
Read user mailbox settings
offline_access
Microsoft Graph
Delegated
Maintain access to data you have given it access to
openid
Microsoft Graph
Delegated
Sign users in
profile
Microsoft Graph
Delegated
View users' basic profile
user.read
Microsoft Graph
Delegated
Sign in and read user profile
Add Secondary Email addresses, First name and Surname, Account Creation date, User Principal Name (UPN), GUID to Archive User account. Without secondary addresses, users will only search content matching their primary address. User Creation date is required for search restrictions.
user.read.all
Microsoft Graph
App
Read all users' full profiles
Search and List user accounts when selecting accounts for Mailbox Reader, Folder Replication or User Directory.
user.readbasic.all
Microsoft Graph
Delegated
Read all users' basic profiles
full_access_as_app
Office 365 Exchange Online
App
Use Exchange Web Services with full access to all mailboxes
Restore to Mailbox
Additional Resources:
Last updated