Configure O365 Message Tracking

The following steps are required to configure O365 Message Tracking in the Azure portal so that an O365 Message Tracking collector can be setup in Axon.

Create an Application in the Microsoft Entra Portal

To open the Entra Portal and create an application:

1. From the Azure Services homepage, click Microsoft Entra ID.
   

   

2. (Optional.) If you have more than one directory, select the correct directory name.
3. On the directory page, click App Registrations in the menu on the left.
   

   

4. In the top menu, click New Registrations.
   

   

5. Complete the fields on the right side of the page:
   • Name the application.
   • Select a support account type.
   • Configure a Redirect URI:
     • Platform: Web
     • Provide a sign-on URL (for example, https://localhost/).
       

       

6. Click Register.
   Your new application appears under the Display Name header.
7. Copy the Application (client) ID and Directory (tenant) ID into a text document for later use.
8. Under the Manage menu on the left, click Certificates & secrets.
   

   

9. Click New client secret.
   

   

10. Enter a detailed Description and select an Expires period, and then click Add.
    

    

11. Copy the Value into a text document for later use.

    

    This value is not accessible once the window is closed. Be sure to copy it now for later use.

Add O365 Message Tracking API Permissions

To add O365 Message Tracking API permissions, from the directory page:

1. Search for your created application under All applications on the App registrations page.
2. Click the name of your application.
   

   

3. In the left-hand menu, click API permissions.
   

   

4. Click Add a permission.
   

   

5. In the Request API permissions pane, on the APIs my organization uses tab, select Office 365 Exchange Online.
   

   

   
   
6. Click Delegated permissions.
   

   

7. Under Delegated Permissions, search for ReportingWebService, expand the ReportingWebService header, and check the Read boxes.
   

   

8. Click Add permissions.
   

   

   
   Verify that your changes have been saved on the API permissions page.
   

   

9. Return to the Office 365 Exchange Online page (refer to step 4).
10. Click Application permissions.
    

    

11. Under Application Permissions, search for ReportingWebService, expand the ReportingWebService header, and check the Read.All box.
    

    

12. Click Add permissions.
    

    

    
    Verify that your changes have been saved on the API permissions page.
    

    

13. Select Grant admin consent for <Organization Name> to apply the application permissions previously selected.
    

    

14. Select Yes to continue.
    

    

    
    A successful confirmation appears.

Assign Azure AD Roles to the Application

The supported role for applications to access the Reporting Web Service is Global Reader.

To assign this role to the newly registered app:

1. On the left-side menu in the Office 365 portal Admin app, click Admin centers, and then click Azure AD.
   The Azure AD Dashboard appears.
2. On the left-side menu, click Azure Active Directory.
3. From the left-most menu, select Roles & admins.
   

   

4. In the search bar, type Global Reader and click on the role that appears.
   

   

   
   
5. Click Add assignments.
   

   

   
   
6. Type the name of your created app into the search bar and then click Select.
   

   

   
   
7. Click Add.
   

   

   
   Verify that your newly created app is available under Global Reader assignments.
   

   

Disable Multi-factor Authentication for the User Account

Multi-factor authentication must be disabled on the user account. To disable multifactor authentication for the user account that will be identified in Axon:

1. From the main page of the newly created app, click the Owners link under the Manage header.
   

   

2. Make note of the owner account listed.
3. Navigate to the Users page (from the Azure AD homepage).
4. Click the three-dot menu at the top-right of the page and click Per-user MFA.
   

   

5. Disable the MULTI-FACTOR AUTH STATUS for the owner account noted in step 2.