Skip to main content
Version: 10.0

Set up application-level access for Microsoft Office 365 via Graph API

Level: advanced
note

This functionality is available for Creatio 8.3.4 and later.

Use application-level access when Creatio must access Microsoft 365 mailboxes as an application, without relying on delegated authorization for each signed-in mailbox user. In Creatio 8.3.4, application-level access for Graph API applies to email synchronization and sending scenarios. Application-level Graph calendar permissions do not enable full Graph API calendar synchronization in 8.3.4.

Important

To use application-level access in Creatio, enable the ApplicationAsServiceAccount feature. Learn more: Implement a custom additional feature, Manage an existing additional feature.

Use application-level access if your organization needs the following:

  • centralized mailbox access management
  • access to shared or delegated mailboxes through an application flow
  • a controlled allowlist of mailboxes that Creatio can access
  • background synchronization where access is managed by administrators

Use delegated mailbox authorization instead if each user authorizes access to their own mailbox and shared or delegated mailbox scenarios are not required. Learn more: Set up OAuth authentication for Microsoft Office 365 via Graph API.

Restrict access to mailboxes​

Microsoft Graph application permissions can grant broad access to mailboxes in the tenant. To restrict this access, use Exchange Online Role-Based Access Control (RBAC) for Applications. Learn more: Exchange Online Application RBAC (official Microsoft documentation).

Exchange Online Application RBAC lets an administrator do the following:

  • Create a resource scope that defines which mailboxes the app can access.
  • Create an Exchange service principal pointer for the Microsoft Entra application.
  • Assign application roles to the app for that scope.
  • Test whether the app is authorized for a specific mailbox.
Important

Application RBAC permissions and Microsoft Entra permissions are additive. If broad unscoped application permissions remain granted in Microsoft Entra, they can still provide access outside the RBAC scope. Review Microsoft Entra consent and Exchange Online RBAC assignments together.

Select the access flow​

You can configure application-level access in the following ways:

  • Flow 1: Grant access to all mailboxes in the tenant. This flow is simpler and faster. Configure the required application permissions in Microsoft Entra and grant admin consent.
  • Flow 2: Grant access only to specific users or groups. This flow is more secure and requires additional Exchange Online Application RBAC configuration.

If your organization must limit which mailboxes Creatio can access, use Flow 2.

Before you begin, make sure you have the following:

  • a Microsoft 365 tenant
  • a Microsoft Entra app registration for Creatio Graph API access
  • Exchange Online PowerShell
  • Microsoft Entra permissions to manage the application
  • Exchange Online permissions to create service principal pointers, scopes, and role assignments
  • the list or rule that defines which mailboxes Creatio may access
  • the ApplicationAsServiceAccount feature enabled in Creatio

Configure Microsoft Entra for both flows​

This step is required for both Flow 1 and Flow 2. Add User.ReadBasic.All to the Microsoft Entra app together with the mail application permissions.

  1. Log in to Microsoft Entra admin center as an administrator.

  2. Open the Creatio app registration. Learn more: Set up OAuth authentication for Microsoft Office 365 via Graph API.

  3. Click Manage → API permissions.

  4. Add the following Microsoft Graph application permissions required for application-level email synchronization and sending:

    Permission

    Type

    Description

    Mail.ReadWrite

    Application

    Enables the application to create, read, update, and delete mail in mailboxes.

    Mail.Send

    Application

    Enables the application to send mail as users.

    User.ReadBasic.All

    Application

    Enables the application to read basic profile data for users in the tenant. This permission must be configured in Microsoft Entra for both broad tenant access and restricted RBAC access.

  5. Click Grant admin consent according to your organization's security policy.

After this step, choose how broadly the application can access mailboxes based on your selected flow.

Flow 1: grant access to all mailboxes​

Use this flow only if your organization intentionally grants the application access to all mailboxes in the tenant. If broad tenant-wide application access is allowed, proceed directly to Enable application-level access in Creatio. Do not configure Exchange Online Application RBAC for this flow.

Flow 2: restrict access with Exchange Online Application RBAC​

Use this flow if your organization must limit application access to specific users or groups.

Make sure you configured Microsoft Entra before continuing. User.ReadBasic.All must remain configured in Microsoft Entra for this flow.

Use the exact role names, scope type, and mailbox filters recommended by your Microsoft 365 administrator. Learn more about supported roles and testing behavior: RBAC for Applications (official Microsoft documentation). Typical Exchange Online commands used in this flow are as follows:

  1. Connect to Exchange Online PowerShell:

    Connect-ExchangeOnline

  2. Create the Exchange Online service principal pointer for the Microsoft Entra application:

    New-ServicePrincipal `
      -AppId "<Application client ID>" `
      -ObjectId "<Enterprise application service principal object ID>" `
      -DisplayName "<Display name>"

  3. Create or choose the resource scope for allowed mailboxes:

    New-ManagementScope `
      -Name "<Scope name>" `
      -RecipientRestrictionFilter "<Mailbox filter>"

  4. Assign the required application roles to the app for the selected scope:

    New-ManagementRoleAssignment `
      -App "<Application client ID or service principal object ID>" `
      -Role "Application Mail.ReadWrite" `
      -CustomResourceScope "<Scope name>"

    New-ManagementRoleAssignment `
      -App "<Application client ID or service principal object ID>" `
      -Role "Application Mail.Send" `
      -CustomResourceScope "<Scope name>"

  5. Test authorization for each target mailbox:

    Test-ServicePrincipalAuthorization `
      -Identity "<Application client ID or service principal object ID>" `
      -Resource "<Target mailbox>"

Enable application-level access in Creatio​

Enable the ApplicationAsServiceAccount feature before configuring the provider. Learn more: Implement a custom additional feature, Manage an existing additional feature.

  1. Click the to open the System Designer.
  2. Go to the System setup block → the Lookups section.
  3. Open the List of email providers lookup.
  4. Open the "Office 365" Graph API email provider. Learn more: Set up OAuth authentication for Microsoft Office 365 via Graph API.
  5. Select Allow application-level access.
  6. Click Save.

As a result, Creatio will be able to access Microsoft 365 mailboxes at the application level. Depending on your configuration, access is either granted to all mailboxes in the tenant (Flow 1) or restricted to a specific scope of mailboxes managed through Exchange Online Application RBAC (Flow 2).

Validate the setup​

After configuration, run the checks that match the access flow you selected.

For both flows, confirm the following:

  • The provider is saved in Creatio with Allow application-level access enabled.
  • The app can access a mailbox that must be available in Creatio.
  • A test email is sent successfully from that mailbox.
  • Email synchronization runs successfully for that mailbox.
  • Microsoft 365 and Creatio logs show no authorization errors.

For Flow 1, additionally confirm that the app can access any mailbox in the tenant.

For Flow 2, additionally confirm the following:

  • The app can access an in-scope mailbox.
  • The app cannot access an out-of-scope mailbox.
  • Test-ServicePrincipalAuthorization returns the expected result for both mailboxes.

Troubleshooting​

The app can access mailboxes outside the scope​

Check whether broad unscoped application permissions are still granted in Microsoft Entra. Microsoft Entra consent and Exchange Online Application RBAC are additive, so both must be reviewed together.

The app cannot access an in-scope mailbox​

Check the following:

  • The ApplicationAsServiceAccount feature is enabled.
  • The mailbox matches the management scope or administrative unit.
  • The service principal pointer uses the correct Application client ID and Enterprise application service principal object ID.
  • Required role assignments exist for the scope.
  • Test-ServicePrincipalAuthorization returns InScope = True for the mailbox.
  • User.ReadBasic.All is configured in Microsoft Entra.

Email sending fails​

Check that the app has the Application Mail.Send role assignment for the mailbox scope.

Email synchronization fails​

Check that the app has the Application Mail.ReadWrite role assignment for the mailbox scope.

See also​

Set up OAuth authentication for Microsoft Office 365 via Graph API

Migrate mailboxes between Exchange (EWS) and Microsoft 365 (Graph API)

Microsoft Exchange Online RBAC for Applications

Microsoft Graph permissions reference