Exchange Integration with Azure Application Authentication and Graph

Configure a Microsoft Exchange integration using Azure Application Authentication and Microsoft Graph for IXP on Automation Cloud.

Warning:

Microsoft will retire Exchange Web Services (EWS) for Exchange Online on October 1, 2026 (Microsoft announcement). This guide covers the recommended Microsoft Graph API integration method. If you are migrating an existing EWS integration, refer to the EWS to Microsoft Graph API migration guide.

Introduction

This step-by-step guide will show you a popular method for creating a Microsoft Exchange application for Communications Mining™ in your Azure Cloud Platform. You'll learn how to create an Application (client) with an ID and Client Secret, and find your existing Directory (tenant) ID. This will allow users to access Exchange mailbox integrations in Communications Mining.

Why a successful integration is important

Failure to create an Exchange-Communications Mining™ application in Azure can lead to permissions errors that prevent users from accessing their mailbox integrations. To gain the full benefits of Communications Mining, follow these steps and complete the process in its entirety.

The step-by-step integration process

1. Register a new Communications Mining application

1. Sign into your Azure portal.

2. Go to the App Registrations menu and select New Registration.

   

3. Fill in and configure the required fields:

   • Name: for example, uipath-exchange-integration.
   • Supported account types: select the single tenant option.

4. Select Register, which redirects you to a page with details of the registered application, such as Application (client) ID, Directory (tenant) ID.

2. Create a client secret for a Communications Mining application

To keep your application secure, create a client secret as follows. Alternatively, you can authenticate with a certificate: skip this step, and select With private key & thumbprint when you create the integration in step 5, providing the PEM-encoded certificate with its private key and the certificate thumbprint. You can change the authentication method later.

1. Select Certificates and secrets under the Manage drop-down list.

2. Select New client secret under the Client secrets tab.

   

3. This opens the Add a client secret sidepanel.

4. Fill in the required fields:

   • Description: enter a description for the client secret.
   • Expires: select an expiry date. The recommended option is 12 months. Note the expiry date somewhere you will see it: when the secret expires, email ingestion stops until you rotate it.

   

5. Select Add.

6. The client secret is displayed under the Value column.

   

Note:

Azure displays the secret value only once. Therefore, make sure you copy and store it in a safe place. If you ever lose your secret value, create a new one.

3. Set API permissions

When using the Microsoft Graph API

1. Go to API permissions under the Manage drop-down list.

2. Select Add a permission.

   

3. Select Microsoft Graph under the Microsoft APIs tab.

   Figure 1. The Microsoft APIs tab

   

4. Select Application permissions.

   Figure 2. The permission options of Microsoft Graph

   

5. Expand the Mail drop-down list and select the Mail.Read permission.

   Figure 3. Selecting a permission

   

6. Select Add permissions.

7. Select the MailboxFolder.Read.All permission.

   Figure 4. Selecting a permission

   

8. Select Add permissions.

9. Back in the API permissions menu, select Grant admin consent for [Your Organization].

10. Select Yes in the Grant admin consent confirmation pop-up.

4. Restrict mailbox access with an application access policy

By default, the application permissions you granted apply to every mailbox in your organization. To limit the application to only the mailboxes Communications Mining needs, ask your Exchange administrator to create an application access policy. For the steps, check Limiting application permissions to specific Exchange Online mailboxes in the official Microsoft documentation.

Important:

Verify that the policy covers every mailbox you intend to sync before you add it to the integration. A mailbox the policy does not cover is disabled with an ErrorAccessDenied error the first time the sync attempts to read it. For details, check Troubleshooting Exchange integrations.

5. Create a new integration in Communications Mining

1. Go to Communications Mining™ by accessing IXP in Automation Cloud and selecting Communication Data.

2. Select the Integrations tab under the settings option.

3. Select New integration.

   

4. Select an existing project, enter a name for your integration, and, optionally, a title.

5. Select Continue.

   

6. Under Connect with your application, select Graph API.

7. Select the option With application access.

8. Fill in and configure the required fields as follows:

   • Oauth Authority: enter the previously generated tenant ID in the following format: https://login.microsoftonline.com/{tenant_id}.
   • Oauth Client Id: enter the previously generated client ID.
   • Client Secret: enter the previously generated client secret.

9. Select Validate & save credentials to check that your credentials are valid.

   Note:

   Validate & save credentials confirms that your tenant ID, client ID, and secret can authenticate. It does not check access to any mailbox: a mailbox outside your application access policy only surfaces an error after you add it and the sync attempts to read it.

10. Select Continue.

    Figure 5. The create a new integration configuration page

    

11. Select Add Mailbox to open the mailbox form.

12. Enter the email address for which you want to copy emails into Communications Mining™.

13. Select Add Mailbox again to save the mailbox.

14. Select Create Integration.