[en] Modern authentication is a method of identity management that offers more secure user authentication and authorization between a client and a server. Within a single OneTrust account, Microsoft can support either basic authentication or modern authentication, but not both simultaneously. OneTrust therefore recommends configuring Microsoft Exchange email accounts for modern authentication. If using modern authentication, the following procedures must be completed to successfully set up configuration between your Microsoft Exchange email account and the OneTrust application.
Nota
[en] This article offers general guidance for setting up Microsoft Exchange Online. Links to Microsoft’s documentation are referenced throughout this article for additional information. Questions specific to your Microsoft account should be directed to Microsoft.
[en] In order to configure Microsoft Exchange Email Accounts using modern authentication, each of the following steps must be completed.
[en] The following steps must be completed before beginning configuration in Azure Active Directory (Azure AD) and the OneTrust application.
[en] Enable modern authentication in Exchange Online
[en] To begin setting up configuration between your Microsoft Exchange email account and the OneTrust application, you will need to ensure that modern authentication is enabled in Exchange Online. Complete the Enable or disable modern authentication in Exchange Online for client connections in Outlook 2013 or later procedure in this Microsoft article and run the command to enable modern authentication connections.
[en] Disable basic authentication in Exchange Online
[en] Within a single OneTrust account, Microsoft can support either basic authentication or modern authentication, but not both simultaneously. Since OneTrust recommends configuring Microsoft Exchange email accounts for modern authentication, it is also recommended to disable basic authentication. For more information on this process, see this Microsoft article.
[en] Step 1: Register an Application in Azure AD
[en] Once the prerequisites above are complete, you can begin setting up the configuration in Azure AD. You will need register an application using the following steps.
-
[en] Log in to your Azure AD account and navigate to the Azure AD Portal by clicking Portal on the main navigation menu.
-
[en] Click the View button under the Manage Azure Active Directory tile.
[en] The Overview screen for your account appears.
-
[en] On the main navigation menu, click . The App registrations screen appears.
-
[en] Click the New registration button. The Register an application screen appears. Complete the fields, as necessary. For more information, you can find a detailed description of the entries required for each field in the following table.
-
[en] Click the Register button. Once complete, the screen will refresh titled with the name you defined in the step above. On this screen, you'll find the application details within the Essentials section. The Application (client) ID field and the Directory (tenant) ID field will be used in the Configure the Microsoft Exchange Account in the OneTrust Application step below.
[en] Step 2: Define API Permissions in Azure AD
[en] Next you'll define the API permissions for the application you registered.
-
[en] On the main navigation menu, click . The API Permissions screen appears.
-
[en] In the Configured permissions section, click the Add a permission button. The Request API permissions pane appears.
-
[en] Select Microsoft Graph. The What type of permissions does your application require field appears.
-
[en] Select Delegated permissions. Then search for and add the User.Read permission.
-
[en] Select Application permissions. Then search for and add the Mail.Send permission.
Nota
[en] For more information on this permission, see Microsoft's Send mail article.
-
[en] Click the Add permissions button. The permissions are visible in the Configured permissions section.
-
[en] Click the Grant admin consent button. A confirmation modal appears.
[en] Click the Yes button. A confirmation notification will appear when complete.
[en] Step 3: Create a Client Secret in Azure AD
[en] Now you'll create a Client Secret Key that you'll use when setting up the Microsoft Exchange email account in the OneTrust application.
-
[en] On the main navigation menu, select . The Certificates & secrets screen appears.
-
[en] Click the New client secret button. The Add a client secret pane appears, where you'll enter a description for the client secret and an expiration.
-
[en] Click the Add button. The client secret you created will appear in the Client secrets section with the Client Secret in the Value column.
Aviso
[en] The Client Secret details should be saved to a secure location. The Client Secret will be used to set up configuration in the OneTrust application. The Client Secret will not be able to be retrieved once lost and a new secret key will need to be generated.
[en] Step 4: Create a Service Account and Mail-Enabled Security Group in Azure AD
[en] Once you've registered the application in the Azure AD Portal, you'll then need to create a service account and a mail-enabled security group in Azure AD.
Nota
[en] The service account will require a mailbox license.
[en] To create a service account
-
[en] Navigate back to the Overview screen for your Azure AD account.
-
[en] On the main navigation menu, select . The All users (Preview) screen appears.
[en] Click the New user button and complete the fields on the New user screen, as necessary.
[en] Click the Create button to finish creating the service account.
[en] To create a Mail-Enabled Security Group
-
[en] On the main navigation menu, select . The All groups screen appears.
-
[en] Click the New group button. The New Group screen appears.
[en] Click the Create button to finish creating the mail-enabled security group.
[en] Step 5: Create an Authentication Policy and Assign it to the Service Account
[en] Next you'll create an authentication policy via PowerShell and then assign the policy to the service account you created above.
[en] To create an authentication policy
-
[en] Connect to Exchange Online PowerShell.
-
[en] Run the following command in PowerShell, replacing <PolicyName> with the name for your authentication policy.
New-AuthenticationPolicy -Name "<PolicyName>"
[en] The following is an example command to create an authentication policy named Block Basic Auth.
New-AuthenticationPolicy -Name "Block Basic Auth"
[en] To assign the authentication policy to the service account
-
[en] Run the following command in PowerShell, replacing <User Identity> with the service account you created in Step 4 and <PolicyName> with the name you defined for your authentication policy.
Set-User -Identity <UserIdentity> -AuthenticationPolicy "<PolicyName>"
[en] The following is an example command to assign the authentication policy Block Basic Auth to the user account rwest@gilberthughes.com.
Set-User -Identity rwest@gilberthughes.com -AuthenticationPolicy "Block Basic Auth"
Nota
[en] Assigning the authentication policy to the service account may take up to 24 hours to take effect.
[en] Step 6: Configure an Application Access Policy
[en] Now you'll configure an application access policy and limit the scope of application permissions. To do this, you will need the Application (client) ID and the mail-enabled security group that you created. Then complete the Configure Application Access Policy procedure in Microsoft's Scoping application permissions to specific Exchange Online mailboxes article.
[en] Step 7: Configure the Microsoft Exchange Account in the OneTrust Application
[en] After you've finished configuring the necessary settings in Azure AD and PowerShell, you can complete the Microsoft Exchange email account setup in the OneTrust application.
[en] Click the gear icon
in the upper right-hand corner to access Global Settings.
[en] On the menu, select . The Email Settings screen appears.
-
[en] On the Accounts tab, click the Add button. The New Email Account screen appears.
[en] Select Microsoft Exchange. Then click the Next button.
-
[en] Configure the fields, as needed. For more information, you can find a detailed description of the entries required for each field in the following table.
[en] Click the Test button to test the configuration.
[en] Click the Create button.
