Connecting an Azure Application

Introduction

General information about connecting Azure apps to Lucy can be found here, but for the plugin workflow you can follow the steps below.

For this type of deployment you must have administrator privileges in your Azure AD.

---

Azure (EntraID) Settings

Outlook (MSI)

Azure settings

1. Login to your Azure portal and navigate to Microsoft Entra ID (formerly Azure AD).

2. Navigate to App Registrations and create a New Registration.

3. Give the application a name.

4. For the organization type select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox).

5. Define a Web redirect URI like so: https://<yourURL>.<tld>/oauth

6. Click Register.

   
7. In the application overview, click the Redirect URIs option then select Add a platform.

   
8. Select the Mobile and Desktop Applications option, enable all three of the pre-defined URIs, then click Configure.

   
9. Scroll to the bottom of the Authentication page and enable Live SDK Support and Allow Public Client Flows, then click Save.

   
10. Navigate to Certificates & secrets and create a new client secret. Give the secret a name and expiration date, then click Add.

11. Copy the Secret Value. Then navigate to the Overview and copy the Application (client) ID and Directory (tenant) ID as well. You will need all three values for the next steps.

O365 (XML)

Azure Settings

1. Login to your Azure portal and navigate to Microsoft Entra ID (formerly Azure AD).

2. Navigate to App Registrations and create a New Registration.

3. Give the application a name.

4. For the organization type select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

5. Define a Web redirect URI like so: https://<yourURL>.<tld>/oauth

6. Click Register.

   
7. In the application overview, click the Redirect URIs option then select Add a platform.

   
8. Select the Single-page Application option and add the following two redirects:

   1. https://<yourURL>.<tld>/login/login.html

   2. https://<yourURL>.<tld>/new-o365/dist/index.html

9. Navigate to Certificates & secrets and create a new client secret. Give the secret a name and expiration date, then click Add.

10. Copy the Secret Value. Then navigate to the Overview and copy the Application (client) ID and Directory (tenant) ID as well. You will need all three values for the next steps.

Lucy Settings

1. Add the application to your Lucy server using the Application ID, Tenant ID, and Client Secret.

2. Navigate to Settings -> Submitted Email Settings -> Plugin Settings and configure your reporting plugin. For authentication you must enable the HTTP reporting method as well as the authentication setting:

   

   Then select the application you created earlier:

   
3. Click Save.

4. Download and deploy the plugin for your mail client:

   1. Outlook Native (MSI)

   2. Office 365 (XML)

API Permissions explained

EntraID

Permission	Type	Description	Admin consent?
OpenID	Delegated	Sign users in	No
offline_access	Delegated	Maintain access to data after granting access	No
email	Delegated	View user's email address	No
User.Read.All	Delegated	Read all users' full profiles	Yes
GroupMember.Read.All	Delegated	Read group memberships	Yes

O365 Plugin

Permission	Type	Description	Admin consent?
Mail.ReadWrite	Delegated	Create, read, update, and delete email in user mailboxes.	No
User.Read	Delegated	Read the profile of signed-in users. Read basic company information of signed-in users	No
Mail.Send	Delegated	Send mail as users in the organization.	No

Outlook Plugin

Permission	Type	Description	Admin consent?
OpenID	Delegated	Sign users in	No
offline_access	Delegated	Maintain access to data after granting access	No
email	Delegated	View user's email address	No
User.Read.All	Delegated	Read all users' full profiles	Yes
GroupMember.Read.All	Delegated	Read group memberships	Yes

For a complete explanation of MS Graph permissions see their documentation.