Create a Microsoft Modern Exchange Connector (Graph) OAuth Connection to Riva Cloud

Rawan Maarouf
Rawan Maarouf
  • Updated

Contents:

Multi-Factor Authentication (MFA)

If your company requires Multi-Factor Authentication for the Riva connection account to Office 365, then you will be required to validate the account via the MFA mechanism (phone token or email address) when creating the connection.

Alternatively, you could submit a request to your Exchange/Azure administrator to exclude your service account from requiring MFA.

Create the Graph OAuth Connection on Riva Cloud

To create the Microsoft Modern Exchange Connector Graph OAuth connection:

  1. Log in to https://www.rivacloud.com. (Detailed instructions to log in or sign in)
  2. On the Get Started page, select Configure your email.

    (Another way of accessing the page to configure the email would be to click on the dropdown beside the Synchronization category in the side navigation menu and then select Connections)
  3. Select the Office 365 Graph Connection logo.

  4. On the Connection page that appears, input the administrator email and select Connect.

  5. In one or more Microsoft windows that appear, enter the information required to access the desired Office 365 account. You will be required to log in with an Admin account to approve the application and permissions. Note, that Riva does not store any admin passwords. 

    Note: The required information may include Multi-Factor Authentication (MFA).

  6. If you see these Permissions requested page, select Accept.

  7. If the connection setup is successful, select OK.

    Result: The Office 365 Graph OAuth connection is added to your Riva Cloud account.

How to limit specific Mailbox and User access when using "Application Permissions"

When using "Application Scoped" permissions, there is a common concern that the application itself will have access to all mailboxes.

There are controls specific to Exchange Online resources that do not apply to other Microsoft Graph workloads.

For the specific Exchange Online scopes (including MailboxSettings.*, Mail.*, Calendar.*, Contact.*, and, Task.*), it is possible to limit the "Application Scoped" permission to specific Users and Mailbox by using the "Exchange Application Access Policy."

Details on how to use the "Exchange Online Application Access Policy", https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access 

Refer to this Riva article for more specific details, Limiting Mailbox and User Access with Application Permissions using RBAC

List of Microsoft Exchange Online Application Scopes requested

Below is a list of default Riva Cloud requested application scopes and a description of their purposes.

Note: For Riva Cloud customers looking to adjust and limit scope access, please contact the Riva technical support team for guidance.

Permission Name Type Description How Permissions are Used by Riva
User.Read.All Application Read all users' full profiles. Used to look up email addresses to match Microsoft mailboxes.
User.Read Delegated Read the signed-in user’s profile. Used to look up email addresses to match Microsoft mailboxes. Only required for cloud-based multi-tenant admin consent flows.(Riva Cloud Shared Tenant) It is safe to remove for on-premises deployments. You may receive a warning from Entra ID ("this scope is required for application functionality") this can be safely ignored.
Calendars.ReadWrite Application Read and write calendar events. Required when the Calendar sync module is enabled. Used to sync calendar items; can be changed to Calendars.Read if write access is not required.
Mail.ReadWrite Application Read and write access to user mailboxes. Enables email sync and access to the RivaConfiguration folder. Can be reduced to Mail.Read if write access is not required.
Mail.Send Application Send mail as any user. Allows Riva to send messages, such as tracking tokens or forwarded emails.

Riva has optional functionality that makes use of this permission to send out an email summary of errors Riva has encountered. If customers are not utilizing this feature, that this permission can be removed. 
MailboxSettings.ReadWrite Application Full access to mailbox settings. Required to read/write user-specific settings like categories, time zones, and work hours.

Riva utilizes this permission to update the MasterCategory list to include new Riva-specific categories with the specific admin-defined colors.
Contacts.ReadWrite Application Read and write access to user contacts. Used for contact sync. Can be limited to Contacts.Read if write access is unnecessary.
GroupMember.Read.All Application Read all group memberships for all users. Allows Riva to expand distribution lists and gather group memberships.
Tasks.ReadWrite.All Application Read and write all users tasks and tasklists Allows Riva to sync Tasks and Tasklists
MailboxFolder.Read.All Application Read all mailbox folder Allows Riva to read all the users' mailbox folders. Required only to enable the Decline Appointment Polling feature; otherwise optional.
MailboxItem.Read.All  Application Read all mailbox without signed-in user Allows Riva to read all the users' mailbox items, without signed-in user. Required only to enable the Decline Appointment Polling feature; otherwise optional.