Create and Test a Microsoft Modern Exchange Connector (Graph) Connection Riva On Premise

Applies to: Riva On-Premises 2026.2 and higher.

Overview

This article provides the complete process for creating and testing a Microsoft Modern Exchange Connector (Graph) connection for Riva On-Premises.

It consolidates certificate creation, Microsoft Entra application setup, Microsoft Graph permissions, admin consent, mailbox access, connection setup in Riva Manager, and connection testing into a single end-to-end guide.

For more detailed information about individual parts of the configuration, refer to the related articles linked throughout this guide.

To create the connection:

Generate a self-signed certificate on the Riva server.
Create and configure a Microsoft Entra application.
Upload the certificate to the Microsoft Entra application.
Add the required Microsoft Graph permissions.
Grant admin consent.
Optionally restrict the mailboxes that the application can access.
Configure the connection in Riva Manager.
Test the connection.

How the Connection Works

Riva uses Microsoft Graph to access mailbox data for synchronization, including emails, calendars, contacts, and tasks.

Microsoft Graph uses application-level permissions for server-to-server integrations. The registered application acts as itself rather than on behalf of an individual user.

Step 1: Generate a Self-Signed Certificate

A self-signed certificate is typically sufficient when your organization securely manages both the Riva On-Premises server and the Microsoft Entra application.

A third-party-signed certificate is generally unnecessary unless required by your organization's policies.

Windows Server 2016+
Windows Server 2012

Windows Server 2016+

On the Riva server, open PowerShell as an administrator.
Run the following command, replacing YourCertificateName with the certificate name that you want to use. For example, RivaSyncOAuth.
```
New-SelfSignedCertificate -Subject "YourCertificateName" -CertStoreLocation "Cert:\LocalMachine" -KeyExportPolicy Exportable -KeySpec Signature -HashAlgorithm sha256 -KeyLength 2048
```
Optionally, you can append -NotAfter (Get-Date).AddYears(3) to the command to make the certificate valid for 3 years. To extend or shorten the certificate validity period, change the value in AddYears(n) accordingly.
Record the certificate name and certificate-store location. You will need this information when configuring the Riva OAuth connection.
Close PowerShell.

Windows Server 2012

On Windows Server 2012, the Microsoft PowerShell New-SelfSignedCertificate cmdlet cannot be used to generate a self-signed certificate for the Riva OAuth connection to Microsoft 365.

Use MakeCert to generate the certificate.

Step 2: Create and Configure a Microsoft Entra Application

Create a Microsoft Graph application in the Microsoft Entra admin center.

Follow the instructions in:

Create and Configure OAuth App for Modern Exchange Connector (Graph) in Microsoft Entra (Azure)

Record the following values for use when configuring the connection in Riva Manager:

Application (Client) ID
Directory (Tenant) ID

Step 3: Export and Upload the Certificate

Export the Certificate

On the Riva server, select Start.
Search for and open Manage computer certificates.

This opens the Certificate Manager for the local computer.
In the left pane, locate the certificate based on the folder where it was generated. (e.g., Personal > Certificates or Trusted Root Certification Authorities > Certificates)
Right-click the certificate, and then select All Tasks > Export.

This opens the Certificate Export Wizard.
Export the certificate without the private key.
Save it in one of the .cer formats.

For more information about Certificate Stores, see Microsoft’s Certificate Stores documentation.

Upload the Certificate

In the Microsoft Entra admin center:

Navigate to Entra ID > App registrations.
Select the application created for Riva.
Go to Certificates & secrets > Certificates.
Select Upload certificate.
Upload the exported public-key .cer file.

Step 4: Configure Microsoft Graph Permissions

When setting up Riva with Microsoft Graph, configure the following permissions under:

Microsoft Entra admin center > Entra ID > App registrations > [Riva application] > API permissions

Required Permissions

Permission Name	Type	Description	How the Permission Is Used by Riva
`User.Read.All`	Application	Read all users' full profiles.	Used to look up email addresses to match Microsoft mailboxes.
`User.Read`	Delegated	Read the signed-in user's profile.	Used to look up email addresses to match Microsoft mailboxes. This permission is required only for Riva Cloud shared-tenant, multi-tenant admin-consent flows. It can be removed for Riva On-Premises deployments. Microsoft Entra may display a warning that the scope is required for application functionality; this warning can be ignored for an on-premises deployment.
`Calendars.ReadWrite`	Application	Read and write calendar events.	Used to synchronize calendar items. This permission can be changed to `Calendars.Read` if write access is not required.
`Mail.ReadWrite`	Application	Read and write user mailboxes.	Enables email synchronization. This permission can be reduced to `Mail.Read`, depending on your requirements.
`Mail.Send`	Application	Send mail as any user.	Allows Riva to send messages, such as messages containing tracking tokens or forwarded emails. Riva also has optional functionality that uses this permission to send an email summary of encountered errors. The permission can be removed when that functionality is not used.
`MailboxSettings.ReadWrite`	Application	Read and write mailbox settings.	Required to read and update user-specific settings such as categories, time zones, and working hours. Riva also uses this permission to update the master category list with administrator-defined Riva categories and colors.
`Contacts.ReadWrite`	Application	Read and write user contacts.	Used for contact synchronization. This permission can be limited to `Contacts.Read` if write access is not required.
`GroupMember.Read.All`	Application	Read all group memberships for all users.	Allows Riva to expand distribution lists and retrieve group memberships.
`Tasks.ReadWrite.All`	Application	Read and write all users' tasks and task lists.	Allows Riva to synchronize tasks and task lists.

Permission Notes

Application permissions provide consistent access without requiring authentication from each individual user.
Existing accounts with active Microsoft Graph connections do not require revalidation. However, administrators must grant admin consent for newly added permissions.

Step 5: Grant Admin Consent

After the required permissions have been configured for the Riva application, grant admin consent.

In the Microsoft Entra admin center:

Go to Entra ID > App registrations > All applications.
Select the application created for Riva.
Select API permissions.
Review the configured permissions.
Select Grant admin consent for [Tenant Name].
Review the consent prompt, and then select Yes.

Admin consent allows Riva to access mailboxes based on the permissions granted.

Administrators must grant admin consent when new permissions are added to an existing application.

Step 6: Limit Mailbox Access (Recommended)

By default, application permissions grant access to all mailboxes in the Microsoft 365 tenant.

To apply the principle of least privilege and restrict Riva's access to specific users, Microsoft recommends using Role-Based Access Control for Applications.

Riva strongly recommends this approach for securing the integration.

For detailed instructions, see:

Limiting Mailbox and User Access with Application Permissions Using RBAC

RBAC Highlights

Use a mail-enabled security group to define which mailboxes Riva can access.
Create a custom management scope in Exchange Online.
Assign that scope to the Riva application by using a management-role assignment.
Verify access by using PowerShell.

Note: Microsoft is phasing out Application Access Policies. RBAC for Applications is the long-term supported method for access control.

After Consent and RBAC

Once permissions and scope have been granted:

Riva will automatically detect and use Microsoft Graph as the sync method.
If RBAC is configured, only mailboxes within the RBAC-defined scope will be synced.
No user passwords or interactive logins are required.

Step 7: Configure the Connection in Riva Manager

Open the Riva Manager application.
On the menu bar, select Setup.
In the left pane, under Connection Wizards, select Add Email, and then select Microsoft Graph.
On the Welcome page, select Next.
Enter the following information:
- E-mail Address: Enter the primary email address of the Riva connection account or any active email address with a mailbox that is part of the applicable domain and scope.
- Application (Client) ID: Enter the ID from the Microsoft Entra application registration.
- Tenant ID: Enter the directory ID from Microsoft Entra.
- Certificate Name: Select the ellipsis (...), and then select the latest certificate created for the Microsoft Entra application.
- Grant Admin Consent: If admin consent was already granted for the application in Microsoft Entra, leave Request Admin Consent unselected. If admin consent has not been granted, select Request Admin Consent.
Select Next.
If you selected Request Admin Consent, sign in with an administrator account authorized to grant application permissions when the Microsoft 365 sign-in page appears.
On the permissions page, review the requested permissions, and then select Accept.
After you are returned to Riva Manager, select Finish.

If the connection cannot be completed successfully, contact the Riva Support Team.

Step 8: Test the Connection

In Riva Manager, go to Setup.
In the right pane, double-click the Microsoft Graph connection.
Verify that the connection details are correct.
On the Test page, leave the User E-mail field empty.
Select Run Test.

If the test is successful, the following message appears:

Connection Test Succeeded

Troubleshooting

Issue	Suggested Action
Access to mailboxes is failing.	Ensure that the mailboxes are members of the RBAC security group.
Permissions are not taking effect.	Wait 15–30 minutes for the changes to propagate.
Admin consent fails.	Ensure that you are using a Global Administrator account.
Graph API errors occur in Riva.	Confirm that the required Microsoft Graph permissions have been granted and properly consented to.

Migrating From EWS to Microsoft Graph

If you are migrating an existing Riva connection from EWS to Microsoft Graph, contact your Riva account manager or the Riva Support Team for guidance.