# Configuring Microsoft Exchange Online as the Mail Server

Organizations using Microsoft Exchange Online can configure it as the mail server in PAM360 to send onboarding messages, notifications, alerts, and other product-generated emails. PAM360 supports both SMTP and Microsoft Graph API for mail delivery, with OAuth 2.0-based authentication and authorization.

The following topics are covered in this help document:

1. **[Registering PAM360 as an Application on the Microsoft Azure Portal](https://www.manageengine.com/privileged-access-management/help/mail-server-settings-microsoft.html#Registering_PAM360_as_an_Application)**
2. **[Delegating API Permissions to the PAM360 Application](https://www.manageengine.com/privileged-access-management/help/mail-server-settings-microsoft.html#Delegating_API_Permissions_to_the_PAM360_Application)**
3. **[Generating Client Secret on the Microsoft Azure Portal](https://www.manageengine.com/privileged-access-management/help/mail-server-settings-microsoft.html#Generating_Client_Secret_on_the_Microsoft_Azure_Portal)**
4. **[Configuring Microsoft Exchange Online as Mail Server in PAM360](https://www.manageengine.com/privileged-access-management/help/mail-server-settings-microsoft.html#Configuring_Microsoft_Exchange_Online_as_Mail_Server_in_PAM360)**

## 1. Registering PAM360 as an Application on the Microsoft Azure Portal

To integrate PAM360 with Microsoft Azure, you should register PAM360 as an application in the Microsoft Azure portal. The registration process involves specifying essential details about PAM360 and setting up the necessary configurations. Follow these steps to add PAM360 as a new application in the Azure portal.

1. Log in to the **[Microsoft Azure portal](https://portal.azure.com/)**
2. Select the **App registrations** option under the **Azure services** section on the **Microsoft Azure** home page.

   ![Azure_Portal](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo.webp)

3. On the **App registrations** page, click the **+ New registration** button on the top-left corner of the screen.

   ![App_Registrations](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-1.webp)

4. Specify the following details on the **Register an application** page:

   1. **Name** - Enter a display name of your choice for the application (e.g., PAM360).
   2. **Supported account types** - Select the **Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant)** option.
   3. **Redirect URI** - Choose **Web** from the drop-down menu and enter the URI of the PAM360 application in the format: ***<access URL>/pam360redirect/AzureOAuth***. For example, if the access URL is ***https://pamserver:8282*** then the Redirect URI you enter here should be ***https://pamserver:8282/pam360redirect/AzureOAuth***.

      ![Register_Application](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-2.webp)

   > **Caution**
   >
   > Ensure the PAM360 application URI (access URL) you enter in the **Redirect URI** field is the same as the one users can use to access the PAM360 application from other machines. Provide the same link in the **Access URL** field in **section 4**.

5. Click **Register** to add PAM360 as an application in the Microsoft Azure portal. You will be redirected to the **App registrations** page, where you can view the details of the newly registered application.

   ![Registered_Application](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-2.1.webp)

6. You can view the details of your newly added app registration by clicking on the application name from the list of registered applications on the **App registrations** page.

## 2. Delegating API Permissions to the PAM360 Application

To enable PAM360 to send emails through Microsoft Exchange Online, you should delegate the necessary permissions to the PAM360 application in the Microsoft Azure portal. Follow the steps below to delegate the required permissions for PAM360 to send emails securely through **Microsoft Exchange Online**.

1. Go to the **App registrations** page and select PAM360 (the display name entered during app registration) from the list of registered applications.
2. On the left pane, select **Manage** >> **API permissions**.
3. On the **API permissions** page, click the **+Add a permission** button under the **Configured permissions** section to open the **Request API permissions** window.

   ![API_Permissions](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-5.webp)

4. In the **Request API Permissions** window, select **Microsoft Graph** from the available list of Microsoft APIs.

   ![Request_API_Permissions](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-6.webp)

5. In the window that opens, select **Delegated permissions** or **Application permissions**.

   ![Delegated_Permissions](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-7.webp)

6. In the **Request API Permissions** window, locate the following API permissions based on the mail delivery method and permission type you want to configure using the search bar and click the **Add Permissions** button.

   1. **SMTP, Delegated** - SMTP.Send, offline_access
   2. **API, Delegated** - Mail.Send (del), offline_access
   3. **API, Application** - Mail.Send (app), offline_access

      ![Select_Permissions](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-8.webp)

7. After adding the required permissions, click the **Grant admin consent** button beside the **+ Add a permission** button.

   ![Grant_Consent](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-3.webp)

8. In the pop-up window that opens, click **Yes** to grant consent for the selected permissions.

## 3. Generating Client Secret on the Microsoft Azure Portal

To complete the setup on the Microsoft Azure portal for using Microsoft Exchange Online as the mail server, you need to generate a client secret. PAM360 will use this client secret to authenticate with Microsoft Exchange Online. Follow these steps to generate the client secret on the **Microsoft Azure** portal.

1. Go to the **App registrations** page and select PAM360 (the display name entered during app registration) from the list of registered applications.
2. Navigate to **Manage** >> **Certificates & secrets** from the left pane.
3. Switch to the **Client secrets** tab and click **+ New client secret**.

   ![CLient_Secret](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-4.webp)

4. In the **Add a client secret** window, enter a description for the client secret, choose an expiry period from the drop-down menu, and click **Add**.

   ![Certificates_and_Secrets](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-9.webp)

5. The client secret value will be displayed under the **Value** column on the **Certificates & secrets** page. Copy and save this value securely, as it will be shown only once. This client secret is required to configure Microsoft Exchange Online as the mail server in PAM360.

   ![Client_Secrets](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mseo-10.webp)

6. Once the application is registered with the required permissions, go to the PAM360 web interface and configure the mail server settings using the obtained client secret value.

## 4. Configuring Microsoft Exchange Online as Mail Server in PAM360

To configure Microsoft Exchange Online as the mail server in PAM360, specify the required mail delivery, connection, authentication, and access settings in the PAM360 interface. Follow these steps to configure Microsoft Exchange Online as the mail server in PAM360:

1. Navigate to **Admin** >> **Server Settings** >> **Mail Server Settings**.
2. In the **Mail Server Settings** window, select the email sending method and the email provider.
   - **Sending Method** - Choose between SMTP or API as the desired email delivery method. If you choose API as the email delivery method, then select the permission type.
     - **Delegated** - Sends email on behalf of an authorized user using OAuth 2.0 authorization.
     - **Application** - Sends email without a signed-in user using the OAuth 2.0 client credentials flow.
   - **Email Provider** - Select Microsoft Exchange Online as the service provider from the drop-down.
3. Under the **Connection Details** section, enter the following details which are required depending on the sending method you selected:
   1. **Server name** - Enter the actual name of the SMTP server, such as ***smtp.office365.com***.
   2. **Port** - Specify the port number for TLS (587) or SSL (465), depending on your setup.
   3. **Sender E-mail Address** - Provide a valid email address for sending onboarding messages, notification alerts, and license expiry reminders. Enter the email address PAM360 should use to send email notifications. For SMTP or API with Delegated permission, specify the mailbox account used to authorize PAM360. For API with Application permission, specify a licensed mailbox that the application is permitted to use for sending email.
   4. **Access URL** - Enter the PAM360 access URL to be included in the mail intimations sent to the users. This URL should match the access URL specified in the **Redirect URI** field in section 1. For example, if the mentioned Redirect URI is ***https://pamserver:8282/pam360redirect/AzureOAuth***, then the Access URL given here should be ***https://pamserver:8282***.

      ![Configure_Mail_Server](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mail-server-setting-1.webp)

4. Under the **Authentication** section, enter your Azure environment credentials:
   1. **Tenant ID** - Enter the directory ID of the Azure application.
   2. **Client ID** - Enter the application ID of the Azure application.
   3. **Client Secret** - Enter the client secret generated on the Microsoft Azure portal.
   4. **Azure Environment** - Choose the appropriate Azure environment from the drop-down menu.

      ![Configure_Mail_Server](https://cdn.manageengine.com/sites/meweb/images/privileged-access-management/help//mail-server-setting-2.webp)

5. After entering the required details, click **Save** to save the configuration.
6. If you selected SMTP, or API with Delegated permission as the sending method, you will be redirected to the Microsoft sign-in page. Log in using the email address specified in the **Sender E-mail Address** field in PAM360 and complete the authorization. This is a one-time operation. This steps does not apply when API is selected as the sending method with Application permission.
7. After saving the mail server configuration and completing the OAuth authorization, click **Test**. Specify the recipient email address to send a test email and verify the mail server configuration.

   > **Additional Detail**
   >
   > For OAuth-based mail server configurations, the **Test** option is enabled only after the mail server settings are saved and the OAuth configuration is completed successfully.

Microsoft Exchange Online is now configured as the mail server in PAM360 using the selected mail delivery method and permission type.