Manual App Registration in Microsoft Entra ID

Manual Registration of the EdbMails application in Microsoft Entra ID (Azure Active Directory) allows administrators to configure the required application settings and establish an OAuth-based connection between EdbMails and Microsoft 365 services. This option is suitable for organizations that prefer to manually manage application registration, API permissions, and authentication settings within their Microsoft 365 environment.

EdbMails uses OAuth-based authentication to securely connect with Microsoft 365 during migration. Both automatic registration and manual registration use OAuth authentication to authorize access. The difference is that manual registration allows administrators to configure the required Entra ID application settings themselves.

Depending on the migration requirements, administrators can choose between the Legacy Method (Exchange Web Services - EWS) and the Modern Method (Microsoft Graph API). The Legacy Method uses OAuth authentication with Exchange Web Services, while the Modern Method uses Microsoft Graph API permissions through a Microsoft Entra ID application registration.

For manual registration, the EdbMails application must first be registered in Microsoft Entra ID, required API permissions must be configured, and a client secret must be generated. Microsoft Entra ID app registration requires an account with Global Administrator privileges or the required permissions to register applications and grant consent. After completing the registration, the generated application details can be entered in EdbMails. To connect and authenticate within EdbMails, you can use either a Global Administrator account or an account with the required Full Access mailbox permissions.

Manual Registration Steps

Select the required method and follow the steps below to register the app manually.

1. Modern Method (Microsoft Graph API)

   Step 1: Register App

   1. Log in to the Microsoft Entra ID Admin Center (Azure Active Directory) using your administrator account.
   2. Navigate to Entra ID, then select App registrations, and click + New registration.

      

   3. Next, enter the display name for the application, and select the type of account to use. For example, for account type select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) on the registration window, and then click Register.

      

   Steps 2: Configure the application permissions

   1. On the application’s Overview page, click View API permissions to access and manage the app’s permission settings.

      

   2. Click the + Add a permission button in the API permissions page

      

   3. Next, in the Request API permissions window, choose Microsoft Graph from the Microsoft APIs section.

      

   4. Then, choose Application permissions from the available options.

      

   5. Choose the following permissions from the list and click Add permissions to apply them.

      Connection to Source Exchange Online (If the app registration is for source account)

      • MailboxFolder.Read.All
      • MailboxItem.Read.All
      • MailboxItem.Export.All
      • User.Read.All
      • People.Read.All
      • Contacts.Read
      • Notes.Read.All
      • Tasks.Read.All
      • Calendars.Read.All
      • Mail.Read

      Connection to target Office 365 (If the app registration is for target account)

      • MailboxFolder.ReadWrite.All
      • MailboxItem.ReadWrite.All
      • MailboxItem.ImportExport.All
      • User.Read.All
      • Contacts.ReadWrite
      • Notes.ReadWrite.All
      • Tasks.ReadWrite.All
      • Calendars.ReadWrite.All
      • Mail.ReadWrite

      

   6. On the API permissions page, click Grant admin consent for userdemo and confirm by selecting Yes.

      

      

   Step 3: Add client secrets to the application in Azure AD

   It is necessary to add client secret to the newly created application. It allows the OAuth protocol to prove the apps existence. Follow the below steps to add a client secret to the EdbMails application which is registered in Azure AD.

   1. Go to Entra ID and then select App registrations. Now select the newly added application
   2. Click on the Certificates & secrets and click on the + New client secret

      

   3. Enter a brief description, choose the desired expiration duration, and then click Add to generate the secret.

      

       Note: Copy the client secret value to the clipboard or directly use it in the EdbMails application. Once you leave the page, the value will not be displayed again. Then you need to create another client secret.

      

   4. Navigate to the 'Overview' section to copy the 'Application (Client) ID' and 'Directory (Tenant) ID', then paste them into the EdbMails application.

      

   Step 4: Fill in the necessary registration details for Login in EdbMails

   • Check the option 'Manual Registration' in the wizard and click the 'Next' button.

     

   • Now enter the 'Email address', 'Application (client) ID', 'Directory (tenant) ID' and 'Client Secret' and click on the 'Login' button

     

      Note: Follow the above steps for the Source and Target Office 365 servers separately.

2. Legacy Method (EWS)

   Step 1: Manually register the EdbMails application in Microsoft Entra ID

   1. Sign in to the Microsoft Entra admin center using an administrator account.
   2. In the left-hand menu, select Entra ID, go to App registrations, and click + New registration.

      

   3. Enter a display name for the application and select the appropriate account type. For example, select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant), and then click Register.

      

   Step 2: Configure the application permissions

   1. On the application's Overview page, select View API permissions to open the application's permission settings.

      

   2. On the API permissions page, click + Add a permission.

      

   3. In the Request API permissions window, select Microsoft Graph under Microsoft APIs.

      

   4. Select Application permissions from the available permission types.

      

   5. Select the required permissions from the list and click Add permissions.

      Connection to Source Exchange Online (if the app registration is for the source account)

      • Directory.Read.All
      • Group.Read.All
      • MailboxSettings.ReadWrite
      • User.Read.All
      • Organization.Read.All

      Connection to target Office 365 (if the app registration is for the target account)

      • MailboxSettings.ReadWrite
      • Organization.Read.All
      • User.Read.All
      • User.ReadWrite.All

      

   6. On the API permissions page, click Grant admin consent and confirm by selecting Yes.

      

      

   7. After granting consent, click + Add a permission to add the required Office 365 Exchange Online permissions.

      

   8. Go to the APIs my organization uses tab, search for Office 365, and select Office 365 Exchange Online.

      

   9. Select Application permissions, expand Other permissions, select the required permissions, and click Add permissions.

      Connection to Source Exchange Online (if the app registration is for the source account)

      • full access
      • User.Read.All
      • Mail.Read

      Connection to target Office 365 (if the app registration is for the target account)

      • full access
      • User.Read.All
      • Mail.ReadWrite

      

   10. On the API permissions page, select Grant admin consent and click Yes when prompted to approve the permissions.

       

       

   Step 3: Add a client secret to the application in Microsoft Entra ID

   Add a client secret to the newly registered application. The client secret is used by the OAuth authentication flow to authenticate the application. Follow these steps to create the client secret for EdbMails.

   1. Go to Entra ID, select App registrations, and open the application you created.
   2. Select Certificates & secrets and click + New client secret.

      

   3. Enter a brief description, select the required expiration period, and click Add to create the client secret.

      

        Note: Copy the client secret value immediately and save it securely or enter it directly in the EdbMails application. The secret value is displayed only once. If you do not save it, you must create a new client secret.

      

   4. Open the Overview section and copy the Application (Client) ID and Directory (Tenant) ID. You will need these values when connecting the account in EdbMails.

      

   Step 4: Enter the registration details in EdbMails

   • In the EdbMails connection wizard, select Manual Registration and click Next.

     

   • Enter the Email address, Application (Client) ID, Directory (Tenant) ID, and Client Secret, then click Login.

     

       Note: Complete the same registration process separately for the source and target Office 365 accounts when both connections require manual registration.