Configuring OAuth authentication for Incoming Mail agent

Registering OAuth authentication in Azure

You can use the OAuth 2.0 authentication service that is provided by Microsoft Entra ID to enable Maximo Real Estate and Facilities application to connect with IMAP, or POP protocols to access Exchange Online in Office 365. For more information, see Authenticate an IMAP, POP or SMTP connection using OAuth.

1. Start the Microsoft Azure app registration screen from the following URL: https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/ApplicationsListBlade
2. Under Manage, select App registrations > New registration to begin the app registration process:

   Name

   Specify the name to identify the registration in the Microsoft Azure portal. For example, TririgaIncomingMailAgent.

   Account Type

   Select the single tenant account type.

   Register

   Click Register. When registration finishes, the Azure portal displays the app registration's Overview page. Make a note of the Application ID.

3. Create a client secret, complete the following steps:
   1. Click Certificates & secrets.
   2. Click New client secret.
   3. Provide a description and a duration for the client secret.
   4. Click Add.
   5. Copy the client secret value from the Value column. This value is later provided in the OAuth Application Secret field of the Microsoft OAuth profile record in Maximo Real Estate and Facilities.
      Note: The client secret can be viewed immediately after creation only, so note of the value before leaving the page.
4. Click Overview and then click the Endpoints tab. Copy OAuth 2.0 authorization endpoint (v2) and OAuth 2.0 token endpoint (v2).
5. Configure API permissions, complete the following steps:
   1. Click API permissions > Add a permission.
   2. Select the APIs my organization uses tab and search for Office 365 Exchange Online.
   3. Click Application permissions.
   4. Select the following permissions:

      POP.AccessAsApp

      IMAP.AccessAsApp

   5. Click Add permissions.
   6. Click Grant admin consent for "application name" for providing consent. You need admin access to view the option to grant admin consent.
   7. Click Yes.
6. Register the Service principal in Exchange Online PowerShell by running the following PowerShell commands:
   1. Install the ExchangeOnlineManagement and connect to your tenant ID:

      
      Install-Module -Name ExchangeOnlineManagement -allowprerelease
      Import-module ExchangeOnlineManagement 
      Connect-ExchangeOnline -Organization <tenantId>

   2. Register an Azure AD application's service principal in Exchange:

      New-ServicePrincipal -AppId <APPLICATION_ID> -ServiceId <OBJECT_ID> [-Organization <ORGANIZATION_ID>]

      Use the Client ID as Application ID, Object ID as the Service ID for the application, and the Tenant ID as the ORGANIZATION_ID. You can find these details in the Overview tab of the Azure portal by navigating to Entra ID > Enterprise applications and selecting the application that you have registered. For more information, see New-ServicePrincipal command

   3. Add Mailbox permissions to the application to give access to your mailbox:

      Add-MailboxPermission -Identity "<EXCHANGE_EMAIL_ID>" -User <OBJECT_ID> -AccessRights FullAccess

Configuring OAuth profile in Maximo Real Estate and Facilities

After you register an OAuth application with Microsoft Azure, you must enter the OAuth provider (Microsoft) in Maximo Real Estate and Facilities. To enter the OAuth provider (and OAuth application), you must create a Microsoft OAuth profile record in Maximo Real Estate and Facilities.

Configure the IncomingMailConfig record

Configure the IncomingMailConfig record to use OAuth authentication to connect with IMAP and POP protocols and access email data for Office 365 users.

Next steps

Log in to the Admin Console, navigate to the Agents page, and verify that the Incoming Mail agent is running.