Configuring the Graph API as a Microsoft Email Account Authentication Mechanism

Bright Pattern Contact Center software allows service providers to offer the Microsoft Graph API as an authentication method for Microsoft email on a cluster-wide basis. Enabling this API allows your tenants to use different Microsoft-based email services (e.g., Exchange Online, Office 365, Hotmail.com, Live.com, Outlook.com, etc.), from non-Microsoft email hosts. Note that only one API may be configured per cluster.

The following tutorial explains how to configure a registered app in the Microsoft Azure Active Directory.

Notice: For customers using Exchange Web Services (EWS) for email (e.g., Outlook.com, Hotmail.com), on Oct. 13, 2020, Microsoft stopped Basic Authentication for new email accounts of this type. Moving forward, all new email accounts will use the Microsoft Graph API for OAuth authentication.

This means that any contact centers with email scenario entries of the Microsoft EWS type must be transitioned to the new Microsoft Graph type. Note that existing accounts will not be immediately affected; however, all accounts should be transitioned before mid-2021.

Configure a Registered App

In order to enable the Microsoft Graph API in your cluster, you must create a registered app in Microsoft Azure Active Directory.

App Registration

1. Go to https://portal.azure.com and log into your account.
   
   
2. Navigate to Azure Active Directory. Depending on your Microsoft Azure tenant configuration, you may need to create a new directory first.
   
   
3. From your directory, click on App registrations.
   
   

   

   App registrations

   
   
   
4. From App registrations, click New registration. From here, you will do the following:
   
   
   • Name your app
     
     
   • Define the Supported account types
     
     

     

     Register an app

     
     
     
5. When you are finished, click Register. You will be redirected back to the Registered app page. Note: You will see your app’s Application (client) ID. Save this somewhere as you will need it when configuring the MS Graph API in the Service Provider application.

Configure Redirect URIs and App Authentication

1. From the Registered app page, click on Redirect URIs. This will take you to the app's Manage > Authentication section.
   
   

   

   Redirect URIs

   
   
   
2. In section Platform configurations, click Add a platform.
   
   
3. Then in section Web, set the following Redirect URIs:
   
   
   • https://<yourcluster.yourdomain.com>/sysmgmt/mscallback.html
     
     
   • https://<yourcluster.yourdomain.com>/admin/mscallback.html
     
     

     

     Define the additional Redirect URI

     
     
     
4. Scroll down to the Implicit grant section. Here, select Access tokens and ID tokens.
   
   
5. When you are finished, click Save.
   
   

Create a Client Secret

1. After you have defined your app’s authentication, click Certificates & secrets.
   
   
2. In section Client secrets, click New client secret.
   
   

   

   Client secrets

   
   
   
3. Next, name the client secret and define when it will expire. Click Add when you are finished.
   
   
4. When your secret is available, click the copy button and save the client secret value with the Application (client) ID; this will be required for configuring the MS Graph API in the Service Provider application as the Application Client Secret.
   
   Please note: You must copy the value when adding the client secret. Once saved, the value will be masked and you will not be able to retrieve the value, and a new client secret will have to be created. Save it in a safe place.
   
   

   

   Define client secret expiration

   
   
   

Set API Permissions

1. After you have created your client secret, click API permissions, and then click Add a permission.
   
   

   

   Add API permissions

   
   
   
2. Select Microsoft Graph from the list, and then select Delegated permissions.
   
   

   

   Graph delegated permissions

   
   
   
3. From the list of delegated permissions, you must select the following:
   
   
   • Mail.Read
     
     
   • Mail.ReadWrite
     
     
   • Mail.Send
     
     
   • User.Read
     
     
   • offline_access
     
     
4. When you are finished, click Add permissions.
   
   
5. Certain permissions may require admin consent. Click the Add admin consent for ___ option, and ensure all appropriate permissions are granted.
   
   
6. Your registered app is now allowed Microsoft Graph API permissions, and you may continue configuration in the Service Provider application.
   
   

   

   Grant the required permissions

You are now finished configuring the Graph API authentication mechanism in Microsoft Azure Active Directory.

---

Next Steps

When you are finished, the following will need to happen before tenants have access to email:

1. Service providers must configure Azure/MS Graph setting in the Service Provider application.
2. Once the API is enabled for the cluster, your tenants may configure new Graph-based email services.< Previous | Next >