contentACCESS documentation – version Orion

During the configuration of Exchange-based jobs it is obligatory to set the Exchange server connections, where the mailbox to be crawled is located. The Exchange connections can be configured on the following pages of the Central Administration:

• In case of Custom jobs on the Exchange connections page (Custom plugins ⇒ General group ⇒ Exchange connections button).

  

  Here select option + new and specify the necessary data in the Exchange connection repository window. By the custom plugins it is possible to configure multiple Exchange connections.

Note: The “+ new” option above the item list is unavailable for the logged on user if the “Add repository items” permission on the tenant is not allowed in his role assignment.
The “manage access” option allows to grant access permissions on the selected Exchange connection for a second user. This “manage access” option is available for the logged on administrator, if his role assignment contains the Edit repository items – All allowed permission on the tenant. Read more in Managing access to contentACCESS objects.

• In case of Email Archive jobs on the System settings page (Email Archive ⇒ Settings ⇒ System settings, under EWS settings section).
  Note: In case the user who has MFA enabled is also Admin for email archiving, the user must use the app password instead of the regular password in the Email archive -> System settings -> EWS settings.

  In case of Email Archive, either an Exchange Online Microsoft 365 or On-premise Exchange server connection can be configured within one tenant. If there are multiple Exchange server versions used in a company (e.g. both Exchange server 2013 and Exchange server 2010), always define the highest Exchange server version in the System settings. Read more in chapter Mixed Exchange environments.

  

  If you are configuring EWS connection to custom plugins, a Connection name must be also entered into the Exchange connection repository dialog. Under Exchange server type and Exchange server version select the type and version of the server, which is used by your email provider. Then enter the EWS URL.

  Region: In case of the user having/using a German cloud (dedicated and isolated Microsoft Azure version for Germany), Germany must be selected in the Region dropdown list.

  In case that the predefined settings for Microsoft 365 and PowerShell don’t match your expectation and/or needs, it is possible to select the Custom option from the Region dropdown list and specify your own values.
  
  

  Use impersonation: By default, this checkbox is turned off. If it is turned on, Impersonation will be used instead of delegation (more information in this section).

  Impersonation allows the superuser account to impersonate any other user’s account and access their mailboxes.

  Note: Only accounts with the ApplicationImpersonation role can use impersonation. For more information about how to configure impersonation for your account, please check this page.

  If the Microsoft 365 user has “desktopless” license, his account can’t be used for impersonation. The problem is that EWS access is disabled for such user (he is unable to connect to EWS).

  EWS authentication mode: Select one EWS authentication mode from the dropdown list. There are 2 options: Basic and Modern. Basic authentication method was used by default in previous versions and it wasn’t possible to select another authentication type. Modern authentication is more secure and complex and requires the app to be registered on Azure portal. How to register it and gain the necessary IDs and client secret is described in this section.
  
  

  Specify the PowerShell URL and select the PowerShell authentication type. PowerShell can use Basic and Modern authentication type, too.

  The EWS and PowerShell data must be requested from the email provider you are using (the configuration properties are the same for On-premise and Hosted Exchange).

  Under Max. connection count option the user may define the number of parallel connections that will be maintained by the system when connecting to PowerShell. It is also possible to disregard any SSL errors with checking the Ignore SSL errors checkbox.

  Keep connection alive: If it is turned on, then the connection between contentACCESS and the Exchange server is cached, which increases the performance. If the Exchange is load balanced, some requests can land on another Exchange and therefore cause errors in contentACCESS. In these cases, unchecking the keep alive option will destroy the connection after each request and will rebuild it on the next request. The recommended settings of “keep alive” option are as follows:

  • If you are communicating with one Exchange server: turn it on to increase the performance
  • If you have a load balanced Exchange environment and there are communication problems with the Exchange: it is recommended to turn it off

  If you want to use an explicit user for exchange connection, check Use explicit credentials and enter the User name and Password. It is also possible to log in under service-credentials. In this case the Use explicit credentials option must be unchecked. Run a test connection via Test button. Do not forget to save the changes.

  

  Screenshot: Exchange connection configurations for custom jobs

  

  Screenshot: Exchange connection configuration in Email Archive system
  Important!!! The user set under Exchange connections must have a full access to the mailbox(es) that he/she would like to archive (in case of not using Impersonation). Provisioning job requires to have “View-Only Organization Management” right on the Exchange. Roles Org Custom Apps, Org Marketplace Apps and User Options must be assigned for the EWS user on the Email archive System settings page, in section EWS settings, if contentACCESS MailApp will be also used. These roles enable an administrator to install and manage custom apps for the organization (read more about the roles here).
  Note: To speed up the email archiving processes, TECH-ARROW has implemented MAPI protocol for communication with the Exchange server. MAPI can be used only in case that the customer has an on premise Exchange server (Exchange 2013 or earlier), and uses contentACCESS with Email archive licence (for custom plugins MAPI cannot be selected). MAPI can be selected only on the email archive /restore/recovery job’s configuration page. By default, contentACCESS uses EWS settings to connect to the Exchange. Some functionalities still require EWS settings. For this reason, it is a must to configure EWS settings as well.
  Important: Microsoft is retiring the RPS (Remote PowerShell) for Exchange Online from the beginning of June 2023. The clients won’t be able to use the RPS protocol to connect to Exchange Online after this date. This means, that the contentACCESS configuration needs to be changed to connect to Exchange Online PowerShell. (Read this article for more information about the Deprecation of Remote PowerShell.)
  Solution: contentACCESS can use modern authentication to connect to Microsoft 365 Exchange Online. This requires an Azure App registration to be configured on the Microsoft 365 tenant. The procedure to create the App registration is described in this chapter.
  For more information about how to configure contentACCESS to use modern authentication for PowerShell on Exchange Online, please refer to this section of the manual.