142. How to configure EzeScan for Microsoft Office 365 Email import

Follow the instructions below to configure an EzeScan Job or Route to use Microsoft Office 365.

📘 Instructions

Firstly an App Registration is to be performed in the Azure Portal. This is to allow EzeScan to be able to connect to the mailbox to download email items.

Part 1 - Performing App Registration

1. The administrator would choose the account type (this needs to be noted for EzeScan configuration later). We would recommend using Single Tenant.

   

   
   

2. The redirect URI needs to be configured. We recommend http://localhost (this needs to be noted for EzeScan configuration later)

   

   
   

3. The client secret needs to be created this needs to be noted for EzeScan configuration later.
   Please note: When creating the secret, we require the secret value, not the secret ID. This needs to be copied upon creation as it can’t be retrieved again. If in error, delete and create a new secret.

   

   
   

4. The API permissions are to be configured.

   

   
   

5. Select Microsoft Graph

   

   
   

6. Select Application permissions and choose:

   1. Mail.ReadWrite

   2. User.Read.All

      

      
      

7. Configured permissions

   

   
   

8. Once all this is completed the EzeScan configuration can be performed. The following information needs to be noted to be passed on to whoever is responsible for configuring in EzeScan:

   • Tenant ID (If Single-Tenant ID)

   • Client ID

   • Client Secret (It is a good idea to internally document when this secret will expire so you can update EzeScan in the future with the next one generated).

   • Redirect URI (should be http://localhost)

If possible. The Azure administrator can approve the registration. Otherwise, it will be performed later in the EzeScan connection.

Part 2 - EzeScan Configuration

The next step is to configure EzeScan to connect to the mailbox.

This step will also require an Azure Administrator to grant consent to the new app registration (if not yet approved).

1. Load EzeScan as an administrator

2. Select Admin → Jobs → Import Tab or Admin → Routing Import Tab

3. Functionality is added as Import Folder “Import Sources” as shown at right and is applicable to both an EzeScan Client and EzeScan Server configurations. Note: Previously you may have a IMAP Import Profile, and may be migrating to Office 365. Untick the IMAP profile (for now) and click and plus icon to add a new connection

   

   
   

4. Click the plus icon to add a new connection and select Microsoft Office 365 outlook from the pull-down list.

5. Change the OAuth Registration to Custom

6. Change the OAuth Registration Type to Single Tenant 

7. Set the Authorisation Type to Client Credentials 

   

   
   

8. Complete the Tenant ID, Client ID, Secret and Redirect URI (from the registration process).

9. Then click on the ... for the admin consent. A web page will display asking for approval.

   
   

   
   

10. Once the wizard above has been completed this screen may return the following error
    This page isn’t working
    localhost didn’t send any data.
    ERR_EMPTY_RESPONSE

11. Close the tab and the connection has been completed.

12. The operator can then configure the rest of the Import Documents Settings below.

    

    
    

13. Note: If migrating from IMAP to Office 365, you can flick between the profiles to note the previous settings and then apply to the newly created Office 365 connection.

14. When complete you can leave the IMAP settings unticked or remove that profile completely.

Restrict application access permissions to specific mailbox

1. Install the module if you don't have it

Install-Module -Name ExchangeOnlineManagement -Force

2. Connect using your administrator credentials

Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.com

3. Add the application access policy

New-ApplicationAccessPolicy -AppId "YOUR_ENTRA_APP_ID_HERE" -PolicyScopeGroupId "target-mailbox@yourdomain.com" -AccessRight RestrictAccess -Description "Restrict Graph Mail.ReadWrite to a specific mailbox."

4. Verify the access policy restriction

# Test access to the allowed mailbox (Should return AccessCheckResult: Granted)
Test-ApplicationAccessPolicy -Identity "target-mailbox@yourdomain.com" -AppId "YOUR_ENTRA_APP_ID_HERE"

# Test access to a restricted mailbox (Should return AccessCheckResult: Denied)
Test-ApplicationAccessPolicy -Identity "other-user@yourdomain.com" -AppId "YOUR_ENTRA_APP_ID_HERE"

For more information about this connection method please see the below Microsoft links which provide more information:

• https://docs.microsoft.com/en-us/graph/auth-register-app-v2

• https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-access-web-apis

• https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access