Microsoft Exchange Online Connector

Microsoft Exchange Online is a cloud-based email, calendaring, and contact service within Microsoft 365, offering secure and scalable communication for businesses.
Using this connector, you can fetch a Message Trace Report, which provides detailed insights into email messages sent and received within your organization.

Prerequisites

To configure the Microsoft Exchange Online Connector, you need:

• A Microsoft account with access to the Azure portal
• Application (client) ID
• Client Secret
• Directory (tenant) ID

Steps to Obtain Prerequisites :

1. Sign in to the Microsoft Entra Admin Center.
2. In the left menu, select Microsoft Entra ID.
3. Click on + Add button >  App Registration.
4. Complete the process:
   • Provide a name for the application.
   • Choose Accounts in this organizational directory only.
5. Once registered, copy the Application (client) ID and Directory (tenant) ID from the Overview page.
6. Navigate to Certificates & Secrets in the application settings and create a Client Secret Key.
7. Copy the Client Secret Value—you will need it when configuring the Microsoft Exchange Online Connector.
   
   Note: Ensure that you copy and save the secret value somewhere safe as it is only visible once.

Assigning Azure Roles to Your Application

To enable the connector to access Exchange Trace Logs, assign the Global Reader and Security Reader roles to your Azure application.

Steps to Assign Roles:

1. Return to the Azure Entra ID page.
2. Click Roles and Administrators in the left menu.
3. In the search bar, enter Global Reader.
4. Click the Global Reader role (do not check the box next to it).
5. Click Add assignments, search for your application, select it, and click Add.
6. To assign the Security Reader role:
   • Go back to Roles and Administrators | All roles.
   • Filter by Security Reader and click the role name.
   • Click Add assignments, search for your application, select it, and click Add.

Granting API Permissions

Your Azure application requires specific API permissions to access the Exchange reports API.

Steps to Grant Permissions:

1. Navigate back to Microsoft Entra ID.
2. Select App Registrations and open your Azure application.
3. In the left menu, click API Permissions, then Add a Permission.
4. The right panel will open. Click APIs my organization uses and search for Office 365 Exchange Online.
5. Click on the result, then:
   • Select Delegated Permissions.
   • Search for Reporting, check ReportingWebService.Read, and click Add Permissions.
6. Add a second permission:
   • Click Add a permission again.
   • Select APIs my organization uses, search for Office 365 Exchange Online, and click on it.
   • Select Application Permissions, search for Reporting, check ReportingWebService.Read.All, and click Add Permissions.
7. Both permissions should now be visible. Click Grant admin consent to finalize and confirm the API permissions.
8. Verify that the API permissions have been correctly granted.

Configurations:

The following are the configurations to forward Microsoft Exchange online Message trace logs to DNIF.‌

Field Name	Description
Connector Name	Enter a unique name for the connector
Tenant ID	Enter tenant ID of your respective tenant
Client ID	Enter the Client Secret Key retrieved from the App
Client Secret	Enter the Client Secret Value retrieved from the App

• Click Save after entering all the required details and click Test Connection, to test the configuration.
• A Connection successful message will be displayed on screen along with the time stamp.
• If the connection is not successful an error message will be displayed. Refer Troubleshooting Connector Validations for more details on the error message.

Note: Once the connector is configured, validate if the connector is listed under Collection Status screen with status as Active. This signifies the connector is configured successfully and data is ready to ingest.