Step-by-step deployment guide
The Exchange Online connector imports mailboxes and the permissions people hold on them, so you can review who can read, send as, or act on behalf of whom.
What This Connector Imports
Mailbox
Every mailbox in the organisation, with its alias, user principal name and recipient type
Permission
One per mailbox and access right, named Mailbox - AccessRight
User
Every recipient in the organisation, plus the principals that hold permissions without being recipients
Authentication Method
The connector authenticates as an application, not as a user. You register an application in Microsoft Entra ID, give it permission to manage Exchange Online, and assign it a role that decides which data it may read.
No mailbox contents are ever read, only who has access to what.
Step 1: Register an Application in Microsoft Entra ID
In the Entra admin centre, go to Identity → Applications → App registrations.
Select New registration.
Give it a name, for example
Elimity Exchange Online.Leave the redirect URI empty (this application never signs a user in)
Select Register.
Note the Application (client) ID and Directory (tenant) ID from the overview page. You will need both.
Step 2: Create a Client Secret
Open your new application and go to Certificates & secrets.
Under Client secrets, select New client secret.
Give it a description and an expiry.
Select Add, then copy the Value immediately.
The secret value is shown only once. If you navigate away before copying it, create a new one.
Note the expiry date. When the secret expires the import will start failing to authenticate, and it needs replacing in the source configuration.
Step 3: Grant the Exchange Online API Permission
In your application, go to API permissions.
Select Add a permission → APIs my organization uses.
Search for Office 365 Exchange Online and select it.
Choose Application permissions, then select Exchange.ManageAsApp.
Select Add permissions.
Select Grant admin consent and confirm.
Step 4: Assign a Role to the Application
The API permission from Step 3 lets the application reach Exchange. A role decides what it may read.
In Entra ID → Roles and administrators, assign Global Reader to the application you registered in Step 1.
Global Reader is read-only across Microsoft 365 and covers everything this connector needs: listing mailboxes and recipients, reading mailbox and Send As permissions, and reading RBAC role groups.
The connector only reads. It never creates, changes or deletes anything in Exchange, so a role with write access is never required.
If a narrower role is required
Some organisations prefer to grant less than Global Reader. The application must at minimum be able to run Get-EXOMailbox, Get-EXORecipient, Get-EXOMailboxPermission and Get-EXORecipientPermission, or the import cannot start.
Get-RoleGroup is optional. Without it the import completes normally, but permissions granted through an RBAC role group are not imported - they are listed as skipped trustees in an alert.
Step 5: Configure the Source in Elimity
Create a custom source and set SDK version to 2.
tenantId
Yes
Directory (tenant) ID from Step 1
clientId
Yes
Application (client) ID from Step 1
clientSecret
Yes
Secret value from Step 2
parallel
No
How many branches run side by side. false (default) is one, true is eight, or give a number
SDK version must be 2. With version 1 the connector cannot split the import and will run until it times out.
Choosing a value for parallel
Left unset, the import runs sequentially. That is the safest first run but the slowest, and on a large environment it can take many hours.
Troubleshooting
An alert mentions Get-RoleGroup is not recognized
The application's role does not allow reading role groups. The import completes without them. See Step 4 if you want those permissions included.
The import fails to authenticate
Usually an expired client secret. Create a new one (Step 2) and update the source configuration.
The import times out
Check that SDK version is set to 2 on the source. With version 1 the import runs as a single request and will time out on a large environment.
Last updated