Configuring Microsoft Azure for OAuth

What is Microsoft Azure?

Microsoft Azure is a public cloud computing service owned by Microsoft. It provides a wide range of cloud services, including analytics, storage, computing, and networking.

What is OAuth?

OAuth is an Open Standard Authorization protocol that allows you to authenticate one application communicating with another on your behalf without sharing the password. It uses client secret values instead of a password to allow access to a secured resource. Thus, the email communication will be secured.

This functionality is applicable from version 7.9 and above.

Configuring Microsoft Azure as Authentication Server

To configure Microsoft Azure as the authentication server, follow the below steps:

1. Sign in to the Microsoft Azure portal.

2. In the Azure services section, click App registrations > New Registration.

3. In the next screen, enter the name, select the Supported account types, and click Register.

The application will appear in the list as shown below.

4. Click on the application, and the below screen appears. Copy the Application (client) ID and Directory (tenant) ID.

5. Go to the Manage > Certificates & secrets > Client secrets tab, and click New Client Secret.

6. Enter the description, select the expiry time, and click Add.

7. The secret appears in the table as shown below. Copy it too.

8. In the Authentication > Advanced settings section, enable the flag “Allow public client flows”, and click Save. By default, it is disabled.

9. In Microsoft Azure, go to Manage > API Permissions tab, and click Add a permission to add permissions for the application.

10. The Request API Permissions popup appears. Click Microsoft Graph.

11. Add Permissions for IMAP or Office 365 Exchange Online (MAPI).

IMAP

Select Delegated Permissions, select the desired permissions for the application, and click Add Permissions.

Office 365 Exchange Online (For MAPI)

1. For Office 365 Exchange, click Add a Permission > APIs my organization uses tab, search for the Office 365 Exchange Online permission, and click on it.

2. Next, click on the Application permissions tab, select the desired permissions, and click Add Permissions.

12. Click Grant admin consent for <application name>. A confirmation window will appear. Click Yes to continue.

13. For IMAP, register your Azure AD Application service principals in Exchange Online and grant access to the Exchange Online mailbox to this service principal. For more details, refer Register service principals in Exchange.
14. For IMAP and MAPI, it is recommended to restrict the mailbox access, so that Azure app can access only a single mailbox. For more details, refer Limiting application permissions to specific Exchange Online mailboxes.

Configuring Microsoft Azure in ServiceOps

Now, login to the ServiceOps Portal, and go to Admin > Support Channel > Emails > Incoming Email Servers tab. Click the Add Incoming Email Server button and the below popup appears.

Enter the required details, paste the copied Client ID, Tenant ID, and Client Secret from Microsoft Azure, and click Save. 

Microsoft Azure is now configured as an email server for ServiceOps.