Create an app in Entra ID

1. Go to https://entra.microsoft.com/ and then to App Registrations.

2. 

   Press New Registration and give the app a name (for example ComArchive).

3. Go to API Permissions in the menu on the left.

   Press Add a permission and select Microsoft Graph. Then select Application permissions and check the following:

   • Calendars > Calendars.ReadWrite

   • Contacts > Contacts.ReadWrite

   • Mail > Mail.ReadWrite

   • Users > User.Read.All

   Press Add permissions.

4. 

   Press Add a permission again. Go to APIs my organization uses.

   Enter ”Office 365” in the search box and select Office 365 Exchange Online from the list.

   Select Application permissions.

   Select Exchange > Exchange.ManageAsApp and add it.

5. Press Grant admin consent for <tenant> to grant consent for these permissions.

Configure roles in Entra ID

1. 

   Now go to Roles & admin in Entra Admin Center. 

   Find Exchange Administrator in the list and pres it.

2. 

   Press Add assignments.

   Press No member selected at the bottom.

3. 

   Search for the name of the Enterprise App previously created.

   Select it and press Select.

4. 

   Press Next and make sure this assignment is permanent. You need to provide a justification. You can use this text or write your own: "Required for ComArchive to work when using Entra ID Enterprise App".

   Press Assign.

   The Enterprise App is now configured correctly.

Configure certificate

1. On the ComArchive server run the following PowerShell commands as administrator:

   $cert = New-SelfSignedCertificate -Subject ComArchive -CertStoreLocation cert:\LocalMachine\My -FriendlyName ComArchiveOffice365 -NotAfter 2030-01-01
   Export-Certificate -Cert $cert -FilePath "C:\Path\To\Cert\ComArchiveApp.cer"
   $cert | fl thumbprint
   

   Adjust the date and path as needed.

   Note the thumbprint returned by the last command. You'll need it later.

2. 

   Now the ComArchive Service User (typically ComArchiveSysAcc) needs access rights to the private key of the newly created certificate.

   Run certlm.msc and find the certificate under Personal. Right click and go to Manage private keys.

   Press Add and find the Service User and grant it read permissions (it does not need Full Control).

3. 

   Now go back to the app registration in Entra ID and go to Certificates and secrets and then to Certificates.

   Press Upload certificate and pick the .cer file created by the PowerShell script.

Configure ComArchive

1. Open the ComArchive Adminstration Tool and go to Active Directory > Exchange Servers. Pick the correct AD domain from the menu and press Connect.

2. 

   Right click an existing connection and select Properties or press Add Microsoft 365 Connection to add a new connection.

   In the dialog box write the domain used in your e-mail addresses in the field at the top. Then select Entra ID Enterprise App under Authentication method.

   Now you need the tenant Tenant ID and Client ID. Both of these can be found on the Overview page of the app in Entra ID.

   Certificate Thumbprint was returned by the PowerShell script.

   You also need to provide your onmicrosoft.com domain in Tenant name. This is needed for PowerShell to connect.

   Remember to check Enable for Mailbox management and press Test Connection to check that the entered values are correct.

   ComArchive has now been configured to Microsoft 365 using Graph.

   Multiple domains

   If you organization has multiple domains configured for the same tenant in Microsoft 365 each domain needs to be added separately in ComArchive. You can use the same Connector User for all of them. ComArchive uses the domain of the e-mail address to determine how to connect to Microsoft 365 and thus all domains need to be configured in ComArchive.

Connecting using Connecter User

1. Create a new user in Microsoft 365. It can have any username you want, but we'll call it ComArchiveConnector here. 

   This user does not need to be assigned a license, unless you wish to be able to assign access rights to it using the graphical Exchange Admin Center and not just PowerShell.

   The Connector User must be excluded from any MFA policies.

2. Grant the Connector User access to all mailboxes. This can be done using the following PowerShell command (using the ExchangeOnlineManagement module):

   Get-Mailbox | Add-MailboxPermission -User <connectoruser> -AccessRights FullAccess

   The Connector User will not automatically get access to new mailboxes

   When creating a new mailbox in Microsoft 365 (for example for a new employee), then Connector User will not automatically gain access to this mailbox. You need to manually assign Full Access permissions using either PowerShell or the Exchange Admin Center or set up an automated solution to run the above PowerShell script regularly. If you don't ensure that the Connector User has access, ComArchive will be unable to archive this new mailbox.

3. Open the ComArchive Adminstration Tool and go to Active Directory > Exchange Servers. Pick the correct AD domain from the menu and press Connect.

   Right click an existing connection and select Properties or press Add Microsoft 365 Connection to add a new connection.

4. 

   In the field Domain name used in e-mail addresses enter the domain used in your e-mail addresses.

   Select Connector user under Authentication method and enter the e-mail address and password for the Connector User.

   Press Test connection. ComArchive should now show a message that connection succeeded.

   Check Enable for mailbox management to enable ComArchive to archive from this Exchange Server.