Mail Server Settings

PAM360 sends email notifications to newly added users to inform them the details about their PAM360 access credentials. Therefore, it is necessary to configure mail server settings prior to adding new users into the product. You can either configure the SMTP mail server used in your environment or use the Microsoft Exchange Online mailbox. PAM360 supports OAuth 2.0 authentication for SMTP-based email communications when using Microsoft Exchange Online. Choosing Microsoft Exchange Online as the mail server will activate OAuth 2.0 authentication for all emails sent from the product. Read further to learn how to configure mail server settings.

  1. Configure Microsoft Exchange Online as the mail server
  2. Configure other mail servers

1. Configure Microsoft Exchange Online as the Mail Server

To configure Microsoft Exchange Online as the mail server in PAM360, you must create an application in the Azure portal and generate the Application ID, Client ID, and Client Secret value. Follow the below steps:

1.1 Steps to Configure an Azure Application for Microsoft Exchange Online Server

  1. Log in to the Microsoft Azure portal.
  2. Click App registrations from the Microsoft Azure homepage.
  3. Click + New registration from the top pane of the App registrations page.
  4. In the Register an application page, enter the following attributes:
    1. Enter a name of your choice.
    2. Choose Supported account types - Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)
    3. For the Redirect URI, choose Web from the drop-down list and enter the URI of PAM360 application in the following format: https://Hostname:port/pam360redirect/AzureOAuth. Please ensure that the PAM360 application URI provided here is the same as the one users can use to access the PAM360 application from other machines. Provide the same link in the Access URL section in step 1.2.
  5. Click Register. PAM360 will be added as an application in the Microsoft Entra ID portal.
  6. You will be taken to the page with the details of the newly registered application.
  7. Click API permissions under Manage in the left pane. In the API Permissions page, click +Add a permission.
    1. In the Request API Permissions page, choose Microsoft Graph.
    2. Search for "SMTP.Send" in the Select Permissions search bar to populate relevant permissions. Select the option SMTP.Send and click Add Permissions.
    3. Search for "offline_access" in the Select Permissions search bar to populate relevant permissions. Select the option offline_access and click Add Permissions.
  8. Now, click the Grant admin consent button beside the + Add a permission button.
  9. In the pop up that opens, click Yes to grant consent for the requested permissions.
  10. Click the Certificates & secrets option on the left pane.
  11. Navigate to the Client secrets tab and click + New client secret.
  12. Enter a description and choose an expiry period. Click Add.
  13. Immediately after creation, the client secret value is displayed under the Value column in the table, copy the value and save it in a secure location. This client secret value will be displayed only once and will not be accessible once you move away from this page.
  14. Once you have registered the application with the appropriate permissions, go to PAM360's web interface and configure mail server settings.

1.2 Steps to Configure Microsoft Exchange Online in PAM360

  1. Navigate to Admin >> Settings >> Mail Server Settings.
  2. In the pop-up form that opens, enter the following:
    1. Server name - The actual SMTP server's name. For e.g. smtp.office365.com.
    2. Port - The default port for TLS is 587 and for SSL is 465. Enter the port that you are using.
    3. Sender E-mail Address - This field requires a valid email address, as PAM360 will send onboarding messages, notification alerts, and license expiry reminders to users. Also, ensure that the user account you specify in this field has the ownership permission for the SMTP enterprise application created in the Azure portal.
    4. Access URL - The URL that is to be displayed on the mail intimation sent to users to access PAM360. Please ensure that the Access URL is the same as the Redirect URI mentioned in step 1.1. For example, if the mentioned Redirect URI is https://win10-prod-qa:8282/pam360redirect/AzureOAuth, then the Access URL given here must be https://win10-prod-qa:8282.
    5. Provider - Choose Microsoft Exchange Online from the dropdown.
    6. Tenant ID - The directory ID of the Azure application.
    7. Client ID - The application ID of the Azure application.
    8. Client Secret - The client secret value created for the Azure application. Click Save to save the settings.
  3. You will be redirected to the Microsoft Azure portal for authentication. Log in using the email address you specified in the Sender E-mail Address field in PAM360. This is a one-time operation.

    4. Now, you have successfully configured Microsoft Exchange Online as the mail server.

2. Configure Other Mail Servers

  1. Navigate to Admin >> Settings >> Mail Server Settings.
  2. In the pop-up form that opens, enter the following:
    1. Server name - The actual SMTP server's name. For e.g. smtp.zoho.com.
    2. Port - Most SMTP servers work with port 25. However, the default port for TLS is 587 and for SSL is 465.
    3. Sender E-mail Address - A valid email address from which you want to send emails to users.
    4. Access URL - The URL that is to be displayed on the mail intimation sent to users to access PAM360.
    5. Provider - Choose Others from the dropdown.
  3. Upon clicking the Requires Authentication checkbox, the pop-up form lists two options:
    • Specify a Username and Password Manually
    • Use an account stored in PAM360
  4. If you choose the first option Specify a Username and Password Manually, enter the authentication details and click Save.
  5. If you choose the second option Use an account stored in PAM360, the resources and accounts that appear in your resources tab will be listed in a dropdown. You can choose the required details and click Save. The chosen Account will be used for authentication. Earlier, in case of a password change, the user has to manually update the new password in the mail server settings. But now, the new password will be automatically updated for authentication.
  6. You also have the option to choose the Secure Connection Protocol - None/SSL/TLS.
    1. SSL - Secure Sockets Layer (SSL) is a cryptographic protocol that enables secure connection over the internet.
    2. TLS - Transport Layer Security (TLS) is a new version of SSL that enables secure connection over the internet.

    Once you have provided the authentication details and the secure connection mode, click Save.

Notes:
  1. It is recommended to use SSL/TLS options for secure communication over the internet /intranet.
  2. If the mail server is using a self-signed certificate, then we need to import it in PAM360.
    • Copy the server certificate and paste it under <PAM360 Installation Folder>/bin directory.
    • From <PAM360 Installation Folder>/bin directory, execute the following command:

      • importCert.bat <name of the server certificate>

    • This adds the certificate to the PAM360 certificate store.
  3. After providing the authentication details and the secure connection mode, you also have the option to test mail server before clicking save.
Top