1. Microsoft 365 APIs configuration

Requirements

1. Global admin access of the Microsoft 365 tenant
2. Notepad to save the values and data needed in the next guide
   • Tenant Name
   • Application (Client) ID
   • Directory (Tenant) ID
   • Secret Key Value

Configuration

Microsoft 365 relies on Azure Active Directory as a directory service. Each Microsoft 365 tenant corresponds to an Azure AD tenant where its user information is being stored. This guide will cover the steps needed to grant your LibraCyber Email Security Gateway permissions on your Microsoft 365 tenant. No changes are made to the Microsoft 365 tenant itself by LibraCyber Email Security Gateway.

Find Tenant Name

• Navigate to https://portal.azure.com/ and log in using your administrator credentials (NOT FROM https://aad.portal.azure.com/ )
• Search for the Domain Names

• The tenant name is going to be the domain that ends with .onmicrsoft.com

App Registration

• Search for the App registrations portal as shown:

• Click on the New registration button

• Insert ESG as the name of the application, choose Accounts in this organizational directory only as of the supported account type and type https://your-esg.domain.com/oauth-login where esg.domain.com is the URL you use to access the ESG appliance in the Redirect URL field.

• Click "Register" once you entered required information correctly
  Note: If you have a LibraCyber ESG Cluster, please add both nodes' addresses under the Redirect URL.

Domain configuration

• Take note of the Application ID shown in the top right corner
• Take note of the Directory (Tenant) ID shown in the top right corner

API permissions configuration

• Click API Permissions and then at the top of the screen select Add a permission

• Select Microsoft Graph API on the right side

• Select Application Permissions
• Select the Read all users’ full profiles (search for user.read.all) 

• Read all groups (search for(group.read.all) under Application permissions

• Select Read organizational contacts (search for OrgContact.Read.All) only if you use Distribution Lists

• Select Read and write mail in all mailboxes (search for Mail.ReadWrite) only if you want to use the Threat Remediation

• Click Add Permissions at the bottom of the page
• Click Grant admin consent for Your Company and click Yes in the dialog

Secret Key configuration

• Now select Certificates and Secrets

• Add a New Client Secret, choose a description, choose a date from the Expiry options dropdown list
• With the latest update of Microsoft security policies, it is no longer possible to generate a perpetual certificate.

• Click Add
• Now copy the newly generated key "Value"  you will need this for the next step.(NOT THE SECRET ID)