Configuring Azure as Authentication Server
To configure Azure as the authentication server,
-
Log in to the Azure portal. Refer here for your Azure Active Directory portal endpoint.
-
Search App registrations.
-
Click App registrations > New registration.
-
On the displayed page, enter a Name for the application and select the required Supported account types.
-
Under Redirect UR, select Web as the platform and enter the redirect URL of ServiceDesk Plus. You can find the redirect URL under Admin > Mail Server Settings.
-
Redirect URI configuration is not required for Application Access permission type.
-
Click Register.
-
On the application details page, copy the Application (client) ID and paste it in the Client ID field in ServiceDesk Plus.
-
Click Endpoints to open the right panel containing all endpoints.
-
Copy OAuth 2.0 authorization endpoint (v2) and OAuth 2.0 token endpoint (v2) and enter them in the Authorization URL and Token URL fields in ServiceDesk Plus, respectively.
-
Go to Certificates & secrets > New client secret.
-
Enter a Description for the client secret.
-
Under Expires, select the validity period for the client secret and click Add.
-
Copy the generated value under Value and paste it in the Client Secret field in ServiceDesk Plus.
Configure API Permissions
Configure the required API permissions based on the permission type selected in Mail Server Settings.
-
Delegated Access
-
Configure API Permissions for Delegated Access
Configure API Permissions for Delegated Access
For Delegated Access, configure the required delegated permissions based on the protocol selected for incoming and outgoing mail.
Incoming Mail - Delegated Access
IMAP
To configure IMAP for incoming mail:
-
Go to API permissions > Add a permission.
-
Select Microsoft Graph.
-
Select Delegated permissions > IMAP and enable the required permission.
-
Click Add permissions.
EWS
To configure EWS for incoming mail:
-
Go to API permissions > Add a permission.
-
Select APIs my organization uses.
-
Search for and select Office 365 Exchange Online.
-
Select Delegated permissions > EWS and enable the required permission.
-
Click Add permissions.
For EWS, the configured delegated permission applies to both incoming and outgoing mail.
Microsoft GraphTo configure Microsoft Graph for incoming mail:
-
Go to API permissions > Add a permission.
-
Select Microsoft Graph.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvX19fX01FX1NlcnZpY2VEZXNrX1BsdXNfX0FQaV9wZXJtaXNzaW9ucygyKS5wbmciLCJDb25kaXRpb24iOnsiRGF0ZUxlc3NUaGFuIjp7IkFXUzpFcG9jaFRpbWUiOjE3ODk1NTUyNDV9fX1dfQ__&Signature=SC0VBFA01R0ZQHvVkktNbfEiHOOCgClh92ORTvo-GRSUCtw4Z04OIWLcNEal~l83-8GdE-NdJDNB0wU~mUXR1kipluzsM-lqdDLNhG9OcFhfI5tQZKsZ98aIxDfrFu5w-VvPiroTiL2y5r15dX82JH-Wr8fPsbyalT0unr0BzDwQFLk~ORa9gtLutib4NINhG4nEZRF5OXle5KmgRsNHpqFxzGaniPw~jGm~5890yi5V-Ovd9-DMfeiSX1q3fJPR0h0Sw-OgCLDSBQYA7WUCyYpc9lreXlcaRpxyjjKPGeB-sIz5ye0Fx0BmuKYJteMip8Lhr4YO2yYMm~Z7~lBEvw__&Key-Pair-Id=K2TK3EG287XSFC)
-
Select Delegated permissions.
-
Enable the required permissions for incoming mail.
- Click Add permissions.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvdW5rbm93bigyNSkucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=BWWzrwDCAtSTyPvJ7Q4Om~f4EGhIND10JFBfNiADXLdxJlaQ-cPIUFLXoM3YnDqILYY9AD6jI5b71QkpRbN7zCx12CHjW807ZrhBXlv7h-IQOxjez-eWo4M95DZb0Rp~HkDuGYWbU-4qk7tpYBGQSKWfj4pNnrqCR7g09F0OKKmjIb0O~M27Syh9OxKFQpvm2KoiOY1302xRsJk0iwrvmIqXL-3yrKjbUCQ2n6humPjiLvHa~ToD~-AJmZd5~lM7MOii0nPqqIHu~6TQ7GTT-aaKo5zL9u4lhHDxscwAUUH0UCACF2PDRGAn5W4vC9PsBqPkPCqCfqW3iZFpFA0fqw__&Key-Pair-Id=K2TK3EG287XSFC)
Outgoing Mail - Delegated Access
SMTP
To configure SMTP for outgoing mail:
-
Go to API permissions > Add a permission.
-
Select Microsoft Graph.
-
Select Delegated permissions > SMTP and enable the required permission.
-
Click Add permissions.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvUmVxdWVzdF9BUElfcGVybWlzc2lvbnMoMSkucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=hXZbCyp-h3xMFVxkUzDqtE24roljRYzWhXrlnQVlpSfJOVF3~6lnOp-EiffiTRRI0ssx8943gtbvIFlaKDRE7liw8PrHI~88O3UZq~trN3x~IMyJNNXCfj9aoqJwn8WHQ1ngZEp9gDpbkTQWchGPMxv7IdaYytTmS2S05Gz3CGzCL8I0xsSiGU63WFL77q3YGX35F~ZypEkJl1hjt4pa2s6BHWTsTdIddVVUtEJ1WNIEwCk-5Y2eEPz4U~sAnk1k9rijr7KiLYmN-xGTbMFNsMlGf-2EWD~mQ83oz4bqAypMZzWrp309vPoEpWWt~7PAivWQ3FrEcNgt4TaYy7O4QQ__&Key-Pair-Id=K2TK3EG287XSFC)
EWS
To configure EWS for outgoing mail:
-
Go to API permissions > Add a permission.
-
Select APIs my organization uses.
-
Search for and select Office 365 Exchange Online.
-
Select Delegated permissions > EWS and enable the required permission.
-
Click Add permissions.
If EWS is configured for both incoming and outgoing mail, the delegated permission configured under Incoming Mail > EWS applies to both.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvUmVxdWVzdF9BUElfcGVybWlzc2lvbnMoMikucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=o~~7KxRa8kQou9j3oc6i7dvjksv5EejUAsqA9lCOMvr8FqsCIxXxalmP6kaukpsF8PJz9kNTEHSa7Ohv6EwiEDDcaZdlZom-NZnQsirzXuCXvMHJMOK07aH47oj5L4HilOk9ynYBoVtVfff2Fq3zHD24u6kJdQDtkGjR9PazXeSLN7a3EB5Uy9KduKqRCBxRJRT~xZyXBOVEoKyKiQ-BiWLK9sAOIznZdVA8J54xq3ewfP0fCNIdqYM0Ak2qIY4X-nyj1uLR8hCSUGdwH8I3FE0DRO0uCQ6M6h~lPwHN804uTrIxq~2VvGww-o5uBgCKiYp-CmIlMwAkFHJLbyVyKw__&Key-Pair-Id=K2TK3EG287XSFC)
Microsoft GraphTo configure Microsoft Graph for outgoing mail:
-
Go to API permissions > Add a permission.
-
Select Microsoft Graph.
-
Select Delegated permissions.
-
Enable the required permissions for outgoing mail.
-
Click Add permissions.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvdW5rbm93bigyNikucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=BGWfv3EowLvr8vhA9b0ItdG0D7Yk7og6R8ieeHf00Q~~zOhWYUMCpb87ayTVFSRy2ePLwroZyNb-8J4KMMJ8vUGqNNNIjbxg4XjwqvFrJxMS1q06YzcIZgk76R5wvg2EM5PkYYbXNx3i~m7B2deIHS-Bd91MCCVaaSAe8tUX1QUHNXnRfnRooEFVcDaJax6-5vBLZLBGp6XjSw8q67EBhyPXP42YryxsmVR6b3cHRbmxKxZkMLObIvEU13WKZ0h2gy4hJ9CF6cWtN8A05r4JhzBAO21hujv-Y3c2L1phLHVAermgxoc3lZ9mKIStxF6zUS-M2JDsd~iTAU579jeLDA__&Key-Pair-Id=K2TK3EG287XSFC)
Grant Admin Consent
For Delegated Access,
-
If user consent for applications is set to Do not allow user consent in the User Consent Settings, grant admin consent for the configured application.
-
-
-
Application Access
-
Configure API Permissions for Application Access
Configure API Permissions for Application Access
For Application Access, configure the required application permissions based on the protocol selected for incoming and outgoing mail.
Incoming Mail - Application Access
IMAP
To configure IMAP for incoming mail:
-
Go to API permissions > Add a permission.
-
Select APIs my organization uses.
-
Search for and select Office 365 Exchange Online.
-
Select Application permissions.
-
Select IMAP.AccessAsApp.
-
Click Add permissions.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvbWFpbF9jbGllbnRfY3JlZGVudGlhbF9mb3ZfX0FsbF9wZXJtaXNzaW9uc19fKDEpLnBuZyIsIkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTc4OTU1NTI0NX19fV19&Signature=JWoRmxDOirqApBHIdM~Aa31Nv~ejRJcMihnhLa1AN7zCNUGq03GCgldl2GcapTErz0UVaWXr3y8JvalibWXpxSwN19FFAER4XSrhjVpK~GI611CdXoLPk5jqi~T-o56jc8nzbhpnYdxb1pvZFZY6FEe1OWCgshmBmFsyrdbJG6kxUMDFkPhrn6Qz5msGjIxX-uGiGm~HhJQxdT1Pekug9~wgPsD0NNwS7P2bS8ctEUQ7OHXnPDQtfjYAWstHGrArWeB7kPHh5TKgYFP92nFQly4r8pMI21zF-e9CeY19oekXa5ijVcv~Olv63~9apfdEHv~Oui8iIAbrUIPdQN1NrA__&Key-Pair-Id=K2TK3EG287XSFC)
EWSTo configure EWS for incoming mail:
-
Go to API permissions > Add a permission.
-
Select APIs my organization uses.
-
Search for and select Office 365 Exchange Online.
-
Select Application Permissions > EWS and enable the required permission.
-
Select the full_access_as_app EWS application permission and click Add permissions.
For EWS, the configured application access permission applies to both incoming and outgoing mail.
Microsoft GraphTo configure Microsoft Graph for incoming mail:
-
Go to API permissions > Add a permission.
-
Select Microsoft Graph.
-
Select Application permissions.
-
Enable the required permissions for incoming mail.
-
Click Add permissions.
Outgoing Mail - Application AccessSMTP
To configure SMTP for outgoing mail:
-
Go to API permissions > Add a permission.
-
Select APIs my organization uses.
-
Search for and select Office 365 Exchange Online.
-
Select Application permissions.
-
Select SMTP.SendAsApp.
-
Click Add permissions.
EWSTo configure EWS for outgoing mail:
-
Go to API permissions > Add a permission.
-
Select APIs my organization uses.
-
Search for and select Office 365 Exchange Online.
-
Select Application Permissions > EWS and enable the required permission.
-
Select the full_access_as_app EWS application permission and click Add permissions.
For EWS, the configured application access permission applies to both incoming and outgoing mail.
Microsoft GraphTo configure Microsoft Graph for outgoing mail:
-
Go to API permissions > Add a permission.
-
Select Microsoft Graph.
-
Select Application permissions.
-
Enable both the required permissions for outgoing mail.
-
Click Add permissions.
Grant Admin Consent For Application Access
To grant admin consent for the configured application:
-
Go to API permissions.
-
Click Grant admin consent for <application name>.
-
Click Yes in the confirmation pop-up.
Prerequisite Configurations for IMAP/SMTP Application AccessIf you use IMAP or SMTP with Application Access, complete the following Exchange Online configurations:
-
Register the Azure Active Directory application as a service principal in Exchange Online.
-
Grant the service principal FullAccess permission to the mailbox that you want to configure in ServiceDesk Plus.
Steps to Configure Exchange Online for IMAP/SMTP Application Access
Step 1: Connect to Exchange Online
Run the following command:
Connect-ExchangeOnline
Step 2 : Register the Azure Active Directory Application as a Service Principal
Run the following command:
New-ServicePrincipal -AppId <Application_Client_ID> -ObjectId <Enterprise_Application_Object_ID> -DisplayName "<Display_Name>"
Replace the placeholders with the following values:
-
<Application_Client_ID>: Client ID of the registered application.
-
<Enterprise_Application_Object_ID>: Object ID of the Enterprise Application associated with the registered application.
-
Use the Object ID from the Enterprise Application Overview page, not the Object ID from the App registrations Overview page.
-
To get the Object ID of the Enterprise Application:
-
Go to Microsoft Entra ID > App registrations and select the registered application.
-
On the App registrations overview page, click the Managed application in local directory link.
-
-
-
You are redirected to the corresponding Enterprise Application.
-
On the Enterprise Application Overview page, copy the Object ID.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvdW5rbm93bigyNykucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=c3YUUTQKHkvaZ~ttJ9bRfPVgUyulJ001VPSUczWJhgxqxfdoBVq6HJXAzlY0t2jb3XEPYyitBRZKTNrOOn8TcMeitOloyALLsOvdpUoeLOT7~mn4YRbGasKKC7Y568nkuMNHVEyZZOxMIZEpGxTocgryB~E8oniuvIKpEUg2417CixD7sDnaCtFSI43J8Yq9QXr3vJydgyD1ncOvA4mMh2zAhsBu69yi6gSSS39Fda~3Gsx74xibbqdyR1XlC-GXwpWfO4NBA-zxJL2RAej4DJjqeoabdFfDOfWnMOSBRShdakENa2y-CaKjv~W9KrnkpMzhSGJZ58mAdz2aGyryQA__&Key-Pair-Id=K2TK3EG287XSFC)
- <Display_Name>: Enter any name to use as the display name of the service principal.
After you execute the command, Exchange Online displays the details of the newly created service principal.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvdW5rbm93bigyOCkucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=Ax17heMPOIuPjORBbn-H~9vVWsd862oUL-HcSkb49BEqdgU~~dnuVkRwse5y4NGGMVNVWMs1WP9DecJOhV~zPSuhxAd0E-QUgWLeq5kuORw5xM-2C-z6uYrADhR9meGrqvpl6oAKNWNS5m27cixQnzQyt6I1D1Ry2wKIipu41MUNWdLCQqVt6nNiiRaE~letdCWkG6IEWbZOqtXDaJ1CW7giA9iaRcIb~QNRbIhNaFcKn-sVqUm4g4lcfFRjJmZ1lftOSoiKzzmveaKBwsRWxoPVNYSb66EYeKHLcFIjGt5GWPqns7p4dmchl4R3b0I4~4z5Brz3x-2XElCSBr1YRg__&Key-Pair-Id=K2TK3EG287XSFC)
Copy the ObjectId from the output. You need this value to grant the service principal access to the mailbox.Step 3: Grant FullAccess Permission to the Mailbox
Run the following command:
Add-MailboxPermission -Identity <Mailbox_UPN> -User <ServicePrincipal_ObjectId> -AccessRights FullAccess
Replace the placeholders with the following values:
-
<Mailbox_UPN>: User Principal Name (UPN) of the mailbox that you want to configure in ServiceDesk Plus.
- <ServicePrincipal_ObjectId>: Object ID of the service principal.
- You can get the service principal Object ID in either of the following ways:
-
Use the ObjectId copied from the command output in Step 2.
-
(or)
-
Run the following command to retrieve the ObjectId:
Get-ServicePrincipal -Identity <Application_Client_ID> | Select-Object DisplayName,AppId,ObjectId
In the command output, the value under ObjectId is the service principal Object ID.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvdW5rbm93bigyOSkucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=YQj3-D7GSs6xJto-dowv5LWsTLyjSzl7AG9tC4pdsImsYd0aTllaCCwiZjj3w3BCIBCp78l9ZF0TuX8CetDVBMzoos61JW~CNYOXoEYYiWXcjCIa5BXb8jtTizgsg~eKNEosbmLQPkcRmVereeY2Cpx4mXzSAay13ycItKwMZCXA-kFs2J-WmYlBzZTYVpAMOA0K1AL86vgjfk401oyj3jmZFpcmIjzEe3QG64-EPV7TJfTtbcgw86pNkH~CfniKcFjAlxpRzmyy23vU~hY3VSFFZbQ5eLvJ7n0v3jlSJPP5eFT3X9Nr9QzUsf9MvxKvG1RVs59lg~CD6yzgSCsa4Q__&Key-Pair-Id=K2TK3EG287XSFC)
Changes in Exchange Online may take some time to take effect. -
-
Configure the Scope
In ServiceDesk Plus, under Authorization Server Details on the incoming or outgoing mail server settings page, the Scope is automatically populated based on the configured Authorization URL and Token URL.
If the Scope is not automatically populated:
-
Enter the required value in the Scope field based on your configuration.
-
Click here to learn more about the required scopes.
-
Click Save.
OAuth authentication with Delegated Access:
-
Enter the account credentials. Ensure that the username matches the username configured in Mail Server Settings.
-
If prompted, provide consent for the specified permissions in the user consent pop-up.
-
Ensure that your browser allows pop-ups and redirects.
.png?Policy=eyJTdGF0ZW1lbnQiOlt7IlJlc291cmNlIjoiaHR0cHM6Ly9kemY4dnF2MjRlcWhnLmNsb3VkZnJvbnQubmV0L3VzZXJmaWxlcy84NjYvMTQyNjIvY2tmaW5kZXIvaW1hZ2VzL3F1LzIwMjYvUGlja19hbl9hY2NvdXIoMikucG5nIiwiQ29uZGl0aW9uIjp7IkRhdGVMZXNzVGhhbiI6eyJBV1M6RXBvY2hUaW1lIjoxNzg5NTU1MjQ1fX19XX0_&Signature=MSSwhH7ZWgyZgsbja146rMG19mvS4MVVf6b~Hk96djoG27vMZyrTJinVbD6KHvLmSC7tA4O3abxza8cT~YMElqb6-sVufCo-naEmCwrAQxWPADhnuOOj3ybY9TJ4K2NuQrXo0H1UUZB4k2CgUeBndtlUNljmb61LUVVe4CtF1u~vZiQfJ3vs8gKPtKyJEk~L6q~7YjnI58ptFN-bWr5wvTRKB8talURwTZ106ZZgwg2xr4YD2vvb3a0WknQFuEek4zyKTiT-g0obgqm5nlfwmZtYf0Yy-uEBMM2YyGCX0pPOvaDCwhFGtET~nRx~w8fMUxbnTcxlNKTAytj40-NQHQ__&Key-Pair-Id=K2TK3EG287XSFC)
Mailbox Write Permissions
When you configure OAuth authentication for Microsoft 365 mailboxes, the application requires write permissions to perform the following mailbox actions:
-
Incoming Mail: Mark emails as read before processing and delete them after processing.
- Outgoing Mail: Create emails in the Drafts folder before sending them and save sent emails in the Sent Items folder.
Without write permissions, ServiceDesk Plus cannot perform these mailbox actions as required.
You have now configured Microsoft Azure as the authentication server for your organization using Microsoft Outlook as the mail server.
Important Links