EWS & OAuth 2.0 Configuration for Office 365

Owned by Elliot Dooleysmith
Last updated: Sept 09, 2022
5 min read

This guide covers how to configure ResourceXpress to use OAuth 2.0 to connect with Office 365.

Pre-requisites & Limitations

Exchange Impersonation for all resource mailboxes is mandatory for the service account(s)

Please see the https://resourcexpress.atlassian.net/wiki/spaces/RSG/pages/106233906 configuration guide for instructions to configure Impersonation

ResourceXpress Settings

To configure OAuth in ResourceXpress first sign into the admin console, using the navigation menu across the top select Administration Settings then System Settings, the OAuth options can be found under the Resource Server tab.

If using a Hybrid Licence ensure Exchange is selected in the Booking System dropdown.

These settings can also be applied to individual Resource Profiles or https://resourcexpress.atlassian.net/wiki/spaces/RSG/pages/125567008.

For individual profiles follow this same procedure but fill in the options found under the Connection Properties tab found in the profile settings.

For Location-based Systems follow this procedure filling in the settings by location found under the Locations tab in System Settings.

Firstly, select Yes for Use OAuth.

The Resource Login User ID is the service account email address that has impersonation rights to all room mailboxes.

Follow the steps below in a new tab/browser window to get get the OAuth Tenant ID, Client ID and Client Secret.

Register an Azure Active Directory App

Navigate to https://portal.azure.com, from here select Azure Active Directory.

From the left-side menu choose App registrations then click New registration.

In the Register an application window enter a name for your application.
Select the Supported account types and click the Register button.

Add API Permissions

Next, select API Permissions under Manage, found on the left menu.

By default the Microsoft Graph User.Read permission is added automatically.
ResourceXpress does not require this permission, so this can be removed.

full_access_as_app required

Click the Add a permission button from the API permission window.

From the Select an API window choose the APIs my organization uses tab.
From the available list or using the search choose Office 365 Exchange Online from the Search List.

Select Application permissions and choose the full_access_as_app option and click Add permissions.

Next, click Grant admin consent and then Accept from the confirmation dialogue box.

Make sure that admin consent has been granted to the full_access_as_app permission, this may require the page to be refreshed.

Mail.Send permission optional

Click the Add a permission button from the API permissions window.

From the Select an API window choose the Microsoft Graph tab.

Select Application permissions and choose the Mail.Send option and click Add permissions.

Next, click Grant admin consent and then Accept from the confirmation dialogue box.

Make sure that admin consent has been granted to the Mail.Send permission, this may require the page to be refreshed.

 

User.Read.All & Group.Read.All permission optional

Click the Add a permission button from the API permissions window.

From the Select an API window choose the Microsoft Graph tab.

Select Application permissions and check the box for the User.Read.All and Group.Read.All options and click Add permissions.

Next, click Grant admin consent and then Accept from the confirmation dialogue box.

Make sure that admin consent has been granted to the permissions, this may require the page to be refreshed.

 

 

Generate the Client Secret

Select Certificates & secrets from the left menu found under Manage.

Then click New client secret.
Enter a Description and select the option for Expiry.

Click Add.

 

Click the Copy to clipboard option for this client secret value, return the ResourceXpress Admin Console tab and paste this value into the OAuth Client Secret field.

Getting the Client & Tenant ID’s

Return to the Azure Portal, select Overview from the left menu.

From here copy the Application (client) ID and Directory (tenant) ID and paste these into the relevant fields in the ResourceXpress Admin Console.

The Azure Portal page can now be closed.

The following macros are not currently supported in the footer:
  • style