OAuth 2.0 for Microsoft O365 with Service Desk Email Reader

Introduction

OAuth 2.0 is introduced in the VSA Service Desk Email Reader for Office 365 in response to Microsoft's lifecycle announcement, in which they indicate that they will begin deprecating Basic Authentication. When using the Basic/Legacy Authentication application sends a username and password with every request, the Exchange service account is granted access to relevant mailboxes using the Application Impersonation role. With Modern Authentication, full access to all mailboxes permission is granted to the VSA application as part of the consent flow. Modern Authentication is based on the OAuth 2.0 protocol which is a token-based authentication, this design ensures that your global administrator credentials are never stored in the application for mail parsing.

With token-based authentication, users would enter their username and password to get a token. This token provides access to the resource for a specific time period. The token is auto-renewed as long as the credentials entered in the parser settings are still valid.

Sections 

• Setup in Azure
  • App Registration
  • Authentication
  • API Permissions
• Setup in VSA Service Desk (KSD)

Setup in Azure

To connect your parser using OAuth 2.0 in Service Desk you will have set up the VSA App in your Azure Portal. Login to https://portal.azure.com using your global administrator credentials.

App Registration

Refer to the below steps/screenshots to register the app.

1. On your Home page, Under Azure services, Click  on Azure Active Directory
2. Under Manage on the left-hand navigation menu, Choose App Registrations > New registration
   
3. Register an Application, provide a name
   • Supported account types: Option 2, Accounts in any organizational directory (Any Azure AD directory - Multitenant)
   • As we are not performing any Oauth authentication on the VSA interface we don’t need to fill the redirect URI
     
4. Click Register
   
5. Copy the Application (client) ID and Directory (tenant) ID from the screen and save it on your notepad
   
6. We will now need to provide Authentication and give API permissions for this app registration in order to access the mailboxes

   

   

   

   

   

Authentication

1. Under Manage on the left-hand navigation menu, Choose Authentication
   
2. Select Yes for Enable the following mobile and desktop flows
   
3. Save

API Permissions

1. On the left-hand side under Manage, Navigate to API Permissions
   
2. Add the permission
   
3. On the Request API permission screen Select Microsoft Graph
   
4. In Graph API choose Delegated permissions
   
5. Permissions needed here are
   
   1. Email
   2. User.Read.All
   3. User.Read
   4. POP.AccessAsUser.All
   5. IMAP.AccessAsUser.All
   6. offline_access
      
   7. SMTP.Send
6. Click on Grant admin consent for user and the status for all these permissions will be set to green.

Setup in VSA Service Desk

Applies to VSA version 9.5.11a or later.

1. Set up the Email Reader for Office 365 per this guide in Service Desk > Configure > Incoming Email and Alarm Settings > Readers tab
   • ID: name of the email reader
   • Host Name: outlook.office365.com
   • Port Number: 993
   • Logon ID: [your mail address]
   • Password: [your mailbox password] 
2. check Use SSL? box
3. select Transport (POP3 or IMAP)
4. check Enable OAuth 2.0 Authentication box
5. Enter the Application ID and Directory ID you saved during App registration earlier.
6. Save your settings and check that new emails sent to the O365 account are processed into Service Desk. Check the Last Error column for any issues with authentication or connectivity.

Upon successful connection, Basic authentication can be turned off. With Basic Authentication, the parser uses a username and password every time it tries to download an email. With Modern Authentication, the parser will present a token for the session instead of a username and password. With the combination of credentials stored, the Application ID and Directory ID parser will generate a token from O365, and the further activities by Parser will be done based on the token. The system will auto-generate a new token when it expires.