Configuring Microsoft 365 (Exchange Online via EWS)

This guide explains how to configure Exchange Web Services (EWS) authentication for Exchange Online (Microsoft 365) to support the Nextcloud Exchange Connector workflow.

Pre-requirements

Before you begin the app registration process, ensure you have the following:

1. Administrative Access: You must have Global Administrator or Application Administrator privileges in your Microsoft Entra ID tenant to grant organizational consent for the required API permissions.

2. Active Microsoft 365 Tenant: An active Microsoft 365 subscription with Exchange Online mailboxes provisioned.

Step 1. Register the Application in Microsoft Entra

Why this is needed: Registering the application generates a unique Application (client) ID and Directory (tenant) ID. These identifiers act as the username and domain for your connector to securely communicate with the Microsoft 365 cloud.

1. Open a browser and log in to the Microsoft Entra admin center.

2. Navigate to Entra ID > App registrations (located in the left sidebar).

3. Click New registration at the top of the page.

4. Fill out the registration form. with the following parameters:

   • Set Name to a friendly name for your app.

   • Set Supported account types to the Single Tenant Only.

   • Redirect URI: Leave this field empty.

5. Click Register.

6. Once the app is created, you will be redirected to the Overview page. Copy and save the following identifiers; you will need them later:

   • Application (client) ID (This will be your AppId)

   • Directory (tenant) ID (This will be your TenantId)

Step 2. Configure Permissions for App-only Access

Why this is needed: The connector operates as a background daemon (server-to-server) without a signed-in user present. It requires "Application permissions" with the full_access_as_app role to impersonate users and sync their calendars and contacts.

1. In your app registration menu, navigate to Manage > API permissions.

2. Click Add a permission > APIs my organization uses and search for Office 365 Exchange Online.

3. Select Application permissions.

4. Check the box full_access_as_app and click Add permissions.

Step 3. Create a Client Secret

Why this is needed: The Client Secret acts as the password for your newly registered application, proving its identity to Microsoft Entra ID when requesting an access token.

1. Navigate to Manage > Certificates & secrets.

2. Under the Client secrets tab, click New client secret.

3. Add a description and choose an expiration period, then click Add.

4. Immediately copy the Value of the client secret. You will not be able to view it again once you leave the page.

Step 4. Save Credentials for Installation

You have successfully generated the required Microsoft 365 access keys. Keep these values secure. Later, when you reach the Installation Guide, you will use these keys to build your configuration files.

Service__ExchangeConfiguration__ExchangeType=1
Service__ExchangeConfiguration__ExchangeTenantId="your-directory-tenant-id-here"

[
  {
    "ExchangeType": 1,
    "AppId": "your-application-client-id-here",
    "ClientSecret": "your-client-secret-value-here"
  }
]

Next Step

Configuring Nextcloud