LibraCyber Archiver fully integrates with Microsoft Office 365. Office 365 relies on Azure Active Directory as directory service. Each Office 365 tenant corresponds to an Azure AD tenant where its user information is being stored.
This guide will cover the steps needed to grant your LibraCyber Archiver permissions on your Office 365 tenant. No changes are made to the Office 365 tenant itself by LibraCyber Archiver.
Configure Office 365 connection
- Navigate to https://portal.azure.com/ and log in using your administrator credentials
- Open the App registrations portal as shown:
- Click on the New registration button on the top left of the page
- Insert Archiver as the name of the application and type the URL you use to access the archiver in the Sign-on URL field
- Take note of the Application (client) ID shown in the top left corner:
- Now click on API permissions on the left menu:
- Click Add a permission
- Select Microsoft Graph API
- Select the following permissions under Application permissions
-
If you want to enable Mailbox delegation, also select the following permissions
- Click Done
- Click Grant admin consent and click Yes in the dialog
- Now select Certificates & secrets section :
- Add a new client secret by typing Archiver in the description and choosing a date from the Expires dropdown list With the latest update of Microsoft security policies it is no longer possible to generate a perpetual certificate.
- Click Save
- Now copy the newly generated key value you will need this for the next step.
WARNING: Be advised that you won’t be able to retrieve it at a later stage!
- Now navigate to your LibraCyber Archiver and select Settings > Authentication > Microsoft 365 Configuration
- Select your tenant and click +
- Give a name to the new connection
- Insert the Application ID you copied before (Note: the Application ID is not the same as the Client ID)
- Insert the password you copied above in the Application key field
- Insert your Microsoft 365 tenant name in the tenant field (This is the tenant name of your office 365, if your admin account is admin@testcompany.onmicrosoft.com, your tenant will more likely just be testcompany.onmicrosoft.com)
- Insert a custom filter if you want to filter users (this is optional and alternative to the field Group)
- Configure the UUID of a Microsoft 365 group if you wish to filter only users the users of this group (this is optional and alternative to the field Filter)
- Insert the default role that will be applied to the imported users. Set this field to USER for normal users. Users authenticated with this authentication method will have this role.
- Check Use for authentication if you want to allow these users to authenticate with the Email Archiver. This is the default and is needed in order to give access to the archiver to the users (through the webapp or the outlook plugin or the mobile apps).
- Click Validate and check if everything is ok.
NOTE: If you receive an Insufficient privileges to complete the operation error wait a few minutes for Azure to clean caches and retry.
- Click Save
Configure Office 365 authentication
Navigate to your LibraCyber Archiver and select Settings > Authentication > Office 365
- Click on the settings icon before the edit button as shown:
- Copy the url that the LibraCyber Archiver has generated
- Navigate to Azure Portal > App registrations > Archiver > Authentication
- Replace the archiver URL with the new URL you copied above
Restrict to a subset of users
You can setup a subset of the users by using a Microsoft 365 group.
- Navigate to https://portal.azure.com/ and log in using your administrator credentials
- Open the Groups section
- Copy and paste the group ID in the corresponding Archiver section