Integrate shared mailboxes in SSQ

​

Pre-requisites

• Global Administrator Role on Entra ID Performing the following operations will require administrator privilege on your Microsoft Entra ID and Exchange Admin portal.
• xorlab Entra ID Application Ensure that an xorlab enterprise application and application registration has been created, which should have been done during the Essential Setup for M365.
• Postman or access to Graph Explorer To create the extension property, necessary to store the shared mailboxes, you will need the Postman software with an account (free) or an access to the Graph Explorer.
  Using API tools with admin credentialsIt is strongly recommended that sensitive credentials are stored only locally and not uploaded to cloud accounts, such as Postman.

​

Configure your xorlab App Registration

1. From the left hand sidebar navigate to Manage -> Certificates & secrets → Client Secrets and create a temporary client secret. You will need it later for creating a custom extension property.
2. Create a PKCS#12 certificate (.pfx) by following the official Microsoft guide below. As a result, you should have two certificate files: .cer and .pfx. Make sure to take note of the certificate password.
   Certificate creation on WindowsFollow the steps from Create a self-signed public certificate to authenticate your application including the optional “Export your public certificate with its private key” section.
3. Upload the public certificate .cer into Certificates in App Registration section.
4. Once the certificate is uploaded, navigate to the API permissions, and add the following application permissions:
   API permissions

   Microsoft APIs → Microsoft Graph:
       User.Read.All
       User.ReadWrite.All 
       Group.ReadWrite.All
       Application.Read.All
       Application.ReadWrite.All
       Application.ReadWrite.OwnedBy
   
   API my organization uses -> Office 365 Exchange Online:
       Exchange.ManageAsApp
   
5. Make sure that the permissions are granted admin consent (Grant admin consent for …).
6. Assign the Exchange Administrator role to the xorlab App Registration:
   1. Navigate to the Microsoft Entra ID -> Roles and administrators.
   2. Search for the Exchange Administrator administrative role in the search bar and open it.
   3. Use the Add assignments button.
   

​

Create the custom extension property

{
    "name": "xorlab",
    "isMultiValued": "true",
    "targetObjects": [
        "User"
    ]
}

1. Import the collection into your Postman software.
2. In the Collection > Variables section, ensure that you are not syncing or sharing any sensitive variables — especially GraphAPIToken and clientSecret. The recommended approach is to store the token and any secrets as a secret variable in your local Postman Vault and reference it directly using {{vault:secret-name}} in your requests. This ensures the token remains secure and is not accidentally uploaded or shared.
3. In Get a token request, replace the different variables and use the request to get a token from Graph API.
4. In Create custom property, replace GraphAPIToken variable with the token returned by the previous request. You should now be able to run the Create custom property request, as a response you will get the property name, it should be: extension_**clientID**_xorlab.

​

Run and automate the script in Azure Automation

    - ExchangeOnlineManagement
    - Microsoft.Graph.Authentication
    - Microsoft.Graph.Users

​

Use the new extension property in xorlab

1. In the Azure portal, search for the xorlab Enterprise Application
2. Navigate to Single Sign On
3. Edit Attributes & Claims
4. Add a new claim named xorlabAddresses (Namespace can be left empty)
5. Select Directory Schema Extension and find your xorlab App Registration
6. Select it and find the user.xorlab attribute
7. Save the changes and open your xorlab instance
8. In the Expert Editor, open the auth.yml file and search for your SAML configuration
9. Set the emails: property to
   emails: sortPrefixedList(attr('xorlabAddresses'), ":")
   

​

Maintenance Task – Updating an Expired Certificate

​

Steps to Renew the Certificate

​

App Registration

• Repeat steps 2 and 3 from the Configure your xorlab App Registration section.
• This will update the certificate at the App Registration level.

​

Azure Automation

• Go to your Automation Account>Shared Resources.
• Navigate to Certificates.
• Remove the existing certificate named cert.
• Upload the newly created .pfx certificate file.
  • Ensure the certificate name is exactly cert.
  • Enter the certificate password.
  • Set Exportable to Yes.