Case Isolation for M365

​

Configuring the app in AAD

1. Open Microsoft Entra Admin Center and select Overview under Identity in the left pane. You will see the Overview page with some basic information for your account, including your Tenant ID. Copy this value and keep it somewhere for use in the last steps. Your Microsoft Entra Tenant ID
2. From the menu on the left, click to expand the Applications section and click App registrations. Select All applications on the page that appears. Application (client) ID
3. Copy the Application (client) ID value for the app used to connect your M365 with xorlab and keep it somewhere, just like you did with the Tenant ID.
4. Click the name of the app. You will see the overview page of the app. Select Certificates & secrets from the left pane or click Add a certificate or secret in the list in the main view: Application certificates and secrets
5. On the Certificates & secrets page for your app, click New client secret: New client secret
6. Enter a description for the client secret and set the expiration time in the Add a client secret pane that shows up on the right. Click Add.
   Please make sure to set a reminder in your calendar for this client secret expiration date, since there is no warning message or other information from M365 on the expiring secret. You will know it has expired only by noticing that the Isolate feature no longer works.
7. The Certificates & secrets page now displays your new client secret. Copy the Value of the secret and keep it somewhere for future use: Secret value
   This value is displayed immediately after the creation of a secret and you can’t see it later after leaving the Certificates & secrets page. If you forget to copy the value or lose the copied value, just delete this secret and create a new one.
8. Select API permissions from the left pane and click Add a permission on the API Permissions page that appears: Adding an API permission for your app
   There can be a default User.Read permission already added to your app. Don’t worry, it’s safe to leave it there.
9. Click the first option—Microsoft Graph—on the Request API permissions pane displayed on the right: Selecting Microsoft Graph API
10. Click Application permissions tile on the next page:
11. Available permissions grouped in categories are displayed. Use the search field to filter the permissions:
    • type mail, expand the Mail group, and check the boxes next to Mail.Read and Mail.ReadWrite Selecting mail permissions
    • type group, expand the Group group and check the boxes next to Group.Read.All and Group.ReadWrite.All (note: group permissions are not required now but the future releases of xorlab might support group case isolation) Selecting group permissions
    • type user.read, expand the User group, and check the box next to User.Read.All Selecting user permissions
12. Click the Add permissions button. On the main API Permissions page, you should see five new permissions granted to the Microsoft Graph API for your app. Click the Grant admin consent for… button above the list to apply the permissions change. New permissions for your app

​

Configuring xorlab

# Microsoft Graph API connectivity
m365GraphApi:

  ## tenant ID as shown in Microsoft Entra ID Portal
  tenantId: "<your tenant id>"

  ## Application (client) ID of your xorlab App Registration as shown in Microsoft Entra ID Portal
  clientId: "<your application id>"

  ## The Client secret value as shown in Microsoft Entra ID Portal: 
  clientSecret:
    plain: "<the value of the secret>"

/etc/xorlab/xcc/backend$ ll m365_graph_api_client_secret.txt 
-rw------- 1 xcc_backend xcc_backend 41 Nov 11 14:13 m365_graph_api_client_secret.txt