Manual Microsoft 365 tenant configuration

If the automatic configuration was not successful due to permission issues, the tenant must be configured manually. To do that, go to Org/Tenant Settings, click Add Tenant, and select Click here to configure with an already existing Azure AD application. Please note that you can also opt to configure manually and skip the automatic configuration altogether with the option provided.

Prerequisite: A service user account with at least View-Only Organization Management, View-Only Audit Logs, and Service Administrator permissions. Click here to learn how to create a Microsoft 365 service account.

Manual tenant configuration involves the following three steps:

1. Create an Azure AD application.
2. Configure the Azure AD application in Exchange Reporter Plus.
3. Configure a service account in Exchange Reporter Plus.

Steps to create an Azure AD application

1. Sign in to the Azure AD portal using the credentials of a Global Administrator account.
2. Select Azure Active Directory from the left pane.
3. Select App registrations.
4. Click New registration.
5. Provide a Name for the Exchange Reporter Plus application to be created.
6. Select a supported account type based on your organizational needs.
7. Leave Redirect URI (optional) blank; you will configure it in the next few steps.
8. Click Register to complete the initial app registration.
9. You will now see the Overview page of the registered application.
10. Click Add a Redirect URI.
11. Click Add a platform under Platform configurations.
12. In the Configure platforms pop-up, click Web under Web applications.
13. In the Redirect URI field, enter http://localhost:port_number/webclient/VerifyUser. For example, http://localhost:8181/webclient/VerifyUser or https://192.345.679.345:8181/webclient/VerifyUser.
14. You can leave the Logout URL and Implicit grant fields empty. Click Configure.
15. On the Authentication page, under Redirect URIs, click Add URI.
16. Enter http://localhost:port_number/webclient/ GrantAccess as the Redirect URI. For example, http://localhost:8181/webclient/GrantAccess or https://192.345.679.345:8181/webclient/GrantAccess.
17. Similarly, using the Add URI option, add http://localhost:port_number/AADAppGrantSuccess.do and http://localhost:port_number/AADAuthCode.do as URIs as well.
18. Again click Add URI to add the below REDIRECT URIs in the subsequent rows. Please note that for users with Exchange Reporter Plus build 5607 or higher, REDIRECT URIs (b) and (c) are optional.
• https://identitymanager.manageengine.com/api/public/v1/oauth/redirect
• https://demo.o365managerplus.com/oauth/redirect
• https://manageengine.com/microsoft-365-management-reporting/redirect.html



Note: The REDIRECT URI must adhere to the following:

19. Click Save.
20. Click Manifest from the left pane.
21. Look for the requiredResourceAccess array in the code.
22. Copy the entire contents from this file and paste them into the section highlighted in the image below. If you want to modify the permissions to be provided, skip this step and follow the steps mentioned in this section.

Application scopes mentioned in the manifest file:

Microsoft Graph scopes

• Domain.ReadWrite.All
• AuditLog.Read.All
• Directory.Read.All
• Reports.Read.All
• User.Read.All
• ActivityFeed.Read
• ServiceHealth.Read

To know more about minimum scopes, click here.

Note:

• If your tenant is being created in Azure China, copy the content below and paste it into the section highlighted in the image below.

[
 {
  "resourceAppId": "00000003-0000-0000-c000-000000000000",
  "resourceAccess": [
   {
    "id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d",
    "type": "Scope"
   },
   {
    "id": "798ee544-9d2d-430c-a058-570e29e34338",
    "type": "Role"
   },
   {
    "id": "da2af54a-6152-42e3-9911-6accce0d5d67",
    "type": "Role"
   },
   {
    "id": "e85629e1-bdf6-470f-821c-f66c4fb9cbe2",
    "type": "Role"
   }
  ]
 },
 {
  "resourceAppId": "c5393580-f805-4401-95e8-94b7a6ef2fc2",
  "resourceAccess": [
   {
    "id": "594c1fb6-4f81-4475-ae41-0c394909246c",
    "type": "Role"
   }
  ]
 },
 {
  "resourceAppId": "00000002-0000-0000-c000-000000000000",
  "resourceAccess": [
   {
    "id": "abefe9df-d5a9-41c6-a60b-27b38eac3efb",
    "type": "Role"
   }
  ]
 }
]



Note: Copy-paste content only from the open square bracket to the closed square bracket. Ensure that all punctuation marks are retained correctly. Once you have pasted the file, it should look like the image below.





23. Click Save.
24. Click API permissions from the left pane.
25. In the Configured permissions section, click ✓ Grant admin consent for <your_company_name>.
26. Click Yes in the pop-up that appears.
27. Click Certificates & secrets from the left pane.
28. Under the Client secrets section, click New client secret.
29. This section generates an app password for Exchange Reporter Plus. In the Description field of the pop-up, provide a name to identify the app to which the
password belongs.
30. Choose when the password should expire.
31. Click Add.
32. Copy the string under Value and save it. This is the Application Secret Key, which you will require later.



33. Go to Certificates and click Upload certificate. Upload your application certificate as a .cer file.
34. If the user has an SSL certificate, the same can be used here. Otherwise, click here for steps to create a self-signed certificate.
Note: Certificate-based authentication is used to contact Microsoft 365 securely and fetch data. During manual configuration, you will be asked to enter your application Secret and upload the Application Certificate.
35. Now go to the Overview section in the left pane.
36. Copy the Application (client) ID and Object ID values and save them. You will need these values to configure your tenant in the Exchange Reporter Plus portal.



37. Go to the App Roles tab and assign the minimum permissions required for the application. Refer to this table to learn about the roles that must be assigned.

Steps to configure the Azure application in Exchange Reporter Plus

1. Return to the Exchange Reporter Plus console.
2. Go to Org/Tenant Settings and select Click here to configure with an already existing Azure AD application.
3. You will be taken to the Configure Microsoft 365 Tenant page.



4. Enter your Tenant Name. For example, test.onmicrosoft.com.
5. Paste the Application ID and Application Object ID values copied in Step 34 of the previous section into the respective fields.
6. For the Application Secret Key, paste the value copied in Step 32.
7. Upload a .pfx file of the certificate that has been uploaded in the Azure portal.
8. Enter your certificate password.
9. If you have an SSL certificate, you can upload the same in the appropriate field.
10. Click Add Tenant.
11. You should now see that REST API access is enabled for the account you configured.

Steps to configure a service account in Exchange Reporter Plus

1. Now the service account must be configured in Exchange Reporter Plus. To do this, click the edit option under the Actions column.
2. Click the edit icon found near Service Account Details.
3. Enter the credentials of the service account you need to configure in the respective fields.
4. Click Update, and close the pop-up window.

Steps to create a self-signed certificate

1. If you require a self signed certificate, go to <Installation Directory>\bin folder and run the Create-selfsignedcertificate.ps1 script as administrator.
2. Before executing the script, run the following command:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Scope process
3. While running the script, you will be asked to add a common name for the certificate, start and end date (yyyy-MM-dd) for the certificate's validity and a private key to protect it.
4. Once you enter the values, the script will create a .pfx file (contains both public and private key) in the bin folder
5. The .pfx file needs to be uploaded in M365 Manager Plus, while the .cer file should be uploaded in the Azure portal of your application.

Previous Topic Next Topic