Configuring Azure as Authentication Server

To configure Azure as the authentication server,

Search App registrations.

Click App registrations > New registration.

On the displayed page, provide a Name and choose the Supported account types.

Under the Redirect URI option, select platform as Web. Type the redirect URL of ServiceDesk Plus. You can find the redirect URL under Admin > Mail Server Settings.
Click Register.

On the next page, you will find the application details. Copy the Application(client) ID details and paste it in the Client ID field in ServiceDesk Plus.

Click Endpoints to open the right panel containing all endpoints.
Copy OAuth 2.0 authorization endpoint (v2) and OAuth 2.0 token endpoint (v2) to Authorization URL and Token URL in ServiceDesk Plus, respectively.

From the left panel, click Certificates & secrets > New client secret.
On the displayed page, provide a Description for the client secret.
Under Expires, choose the validity of the client secret and click Add.

The client secret value will be generated. Copy the string displayed under Value to the Client Secret in ServiceDesk Plus.

To configure EWS in ServiceDesk Plus, click API Permission > Add a permission in the left panel.
In the right panel that pops up, click APIs my organization uses.
Type Office 365 in the search bar and select Office 365 Exchange Online from the list of APIs.

Choose Delegated Permissions > EWS and enable the check box to add the corresponding permission.
Click Add permissions.

To configure IMAP or SMTP in ServiceDesk Plus, click API permissions > Add a permission in the left panel.

In the right panel that pops up, click Microsoft Graph.

Choose Delegated Permissions > IMAP or SMTP and enable the check box to add the corresponding permission.
Click Add permissions.

When configuring mail access by using OAuth for Microsoft 365 mailboxes, the app registration includes write permissions.
These permissions are necessary because the application performs certain mailbox actions while processing emails.
Outgoing Mail: Write permission is required to create emails in the Drafts folder before sending them and to save sent emails in the Sent Items folder.
Incoming Mail: Write permission is required to mark emails as read before processing and to delete them after processing.
Without write permission, the application cannot create drafts, process emails, or manage mailbox items correctly.

IMAP

SMTP

Microsoft Graph (Incoming Mail Server Settings)

Microsoft Graph (Outgoing Mail Server Settings)

If the user consent for application is configured as Do not allow user consent in the User Consent Settings page, you need to grant admin consent for the configured application.

On the displayed page, click Grant admin consent for <application name>. A confirmation window pops up. Click Yes to proceed.

On the configuration page of ServiceDesk Plus, type the Scope based on your configuration. Click here to know more about scopes.
Click Save.

Please ensure that you have not blocked pop-ups and redirects in your browser to view the user consent window.

Provide your login credentials (if required) and submit your consent for permission. The login credential should be the same as the username configured in the Mail Server Settings.

You have now configured Microsoft Azure as the authentication server for your organization using Microsoft Outlook as the mail server.

Important Links

OAuth FAQs

OAuth Troubleshoot