25.26.1.Grant permissions for Email archive
In this section, we describe step by step how to grant permissions for the Email archive, which enables contentACCESS to authenticate and connect to the Microsoft Dataverse environment using a modern and more secure way of authentication.
1) First, click the API permissions button on the left menu on the application details page. When the configured permissions page loads, click the + Add a permission button and select the requested API.
2) On the Request API permissions tab, search for Microsoft 365 Exchange Online and select it.
3) Then select the Application permissions box, where the available permissions from this category will be shown.
Locate the full_access_as_app permission from the Other permissions option and the Exchange.ManageAsApp permission from the Exchange option, then click on the Add permissions button.
4) After the permissions have been assigned to the application, the administrator must grant consent for these permissions. Click on the Grant admin consent for “TENANTNAME” button.
5) The Exchange.ManageAs.App permission allows the applicant to connect to PowerShell but does not grant access to any PowerShell commands or Exchange objects. The permission to access Exchange objects is granted through the Role Based Access Control (RBAC). This means that the App registration needs to be granted to the Exchange Administrator role or Exchange Recipient Administrator role.
First, you need to go back to the Azure Active Directory page, then go to the Roles and administrators | All roles page, select Exchange Administrator from the list, and click the role.
6) After you open the role, click on the Add assignments button, then search for your App registration (Test_app in our example), and assign it to the role. Please note that the App registration is of type “Service Principal”.
7) The roles will be listed on the Exchange Administrator | Assignments page now.
8) When the permissions are assigned to the application, the admin consent is granted, and the roles are assigned, add a new client secret by clicking on the + Next client secret button. This is necessary for some plugins and client applications.
After the configuration is done, copy the client secret shown on the Get client secret dialog box to a secure location so that you can refer to it later. The client secret will be required when configuring certain contentACCESS models with modern authentication– like Email archive, SharePoint archive, Teams archive, GDPR Exchange, and Exchange connection.
Now you can configure contentACCESS to use the modern authentication for PowerShell. Read more about the Exchange connection configuration here.