It is possible to login to the archiver with your office 365 admin account and have admin privileges in the archiver. Login to Azure AD (https://portal.azure.com/) with an admin account
- In the Search bar, type App Registration and click on it
- In App Registration, click on New registration at the top
- Type in a name for the application and type the URL you use to access the archiver in the Sign-on URL field
Click Register
- Take note of the Application (client) ID shown in the top left corner:
- Now click on API permissions on the left menu:
- Click Add a permission
- Select Microsoft Graph and Application permissions
- Select the following permissions under Application permissions
- Click Done
- Click Grant admin consent and click Yes in the dialog
- Now select Certificates & secrets section
- Click New Client secret, type a name in the description, and choose a date from the Expires dropdown list With the latest update of Microsoft security policies, generating a perpetual certificate is no longer possible.
- Click Save
- Now copy the newly generated key value you will need this for the next step.
In the Azure AD, click on groups
Click on New Group In Group Type, choose Microsoft 365 group Enter a name for the group. Eg (Admin Users) Enter a description for the In Membership, leave it as (Assigned) Add owner for the group Add group members Click Create
Once the group is created, click on the group that you just created
In the group details, take note of the Object Id
Go to your ESG Archiver
- Now navigate to your LibraCyber Archiver and select Settings > Authentication > Microsoft 365 Configuration
- Select your tenant and click +
- Give a name to the new connection
- Insert the Application ID you copied before (Note: the Application ID is not the same as the Client ID)
- Insert the password you copied above in the Application key field
- Insert your Microsoft 365 tenant name in the tenant field (This is the tenant name of your office 365, if your admin account is admin@testcompany.onmicrosoft.com, your tenant will more likely just be testcompany.onmicrosoft.com)
- Insert a custom filter if you want to filter users (this is optional)
- In the group's sections, insert the Object ID of the group you created earlier
- In the default role, choose TENANT_ADMIN or any other role that you want to give to the users in this group.
- Check Use for authentication if you want to allow these users to authenticate with the Email Archiver. This is the default and is needed to give access to the archiver to the users (through the web app, the outlook plugin, or the mobile apps).
- Click Validate and check if everything is ok.
Now you will create a connector for the users in the group you just created Click on Archiver on top and click Connectors
- Select a tenant and click +
- Enter the name of the connection
- Click Graph
- Under Configuration, click the drop-down arrow and choose the Microsoft 365 Authentication we created earlier
- Click Validate
- Click Save
Now click on Settings and click Microsoft 365 Configuration
Click the below icon highlighted in the screenshot
Copy the URL
Go back to you
- Navigate to Azure Portal > App registrations, click the app registration you created earlier
- Replace the archiver URL with the new URL you copied above
Go back to the archiver Sign out of the archiver and login using the email address of one of the accounts in the group you just created in Azure AD. Type the email address of the account and click Sign in with office 365
The user account you signed in with will have admin access to the archiver