Set Up OAuth2 for the ACMP Server's email service
With the change to the Microsoft 365 sign-in method, users can no longer sign in using standard authentication as they did before. As of October 1, 2022, Microsoft has disabled traditional authentication using an username and password and replaced it with OAuth2. All applications running on the Microsoft 365 Server (e.g., email traffic) must now be registered in Microsoft Azure Active Directory. If the app ID is not registered, email traffic can no longer pass through the Microsoft Server. Read here to find out what requirements you must meet to set up OAuth2 on the ACMP Server.
Warning:
OAuth2 can only be used starting with Server 2012 R2, since kein TLS 1.2 is not supported in earlier versions.
Note:
When IMAP mailboxes are moved, you must ensure that the UID in the database is also reset. If the last UID that ACMP retrieved is higher than that of the new mailbox, ACMP will not retrieve any emails as long as the last UID in the mailbox is lower. Please contact Support if you have any questions about how to reset the UID.
This also affects the case where a mailbox has been moved from a local Server to Online Exchange!
Requirements for OAuth2
To use OAuth2, the following prerequisites must be met:
- You must register an app (Application/Client ID) in the enterprise application (Microsoft Entra ID). For more information on what you need to consider, see the section Register a company application in Microsoft Entra ID.
- The following permissions must be specified for the app:
- IMAP.AccessAsUser.All
- POP.AccessAsUser.All
- SMTP.Send
- offline_access
Then proceed as follows:
To continue working on the settings, you must now go to the Microsoft 365 Admin Center (https://admin.microsoft.com/Adminportal/Home) and sign in there. All permissions must be enabled for the mailbox you want to access.
Microsoft 365 Admin Center
There, in the left-hand navigation under Users, you'll find the menu item Active Users. Select the user to whom the changes should apply. Open the account settings, go to the Email tab, and click Email Apps > Manage Email Apps.
Select the apps in which the user can access Microsoft 365 emails. At this point, you must select all the checkboxes to grant access.
Warning:
Please note that the “Authenticated SMTP” setting is important and must also be activated. This setting is not always enabled by default!
Manage Email App settings
Configuring Settings in ACMP
After you have made the relevant changes on the selected Microsoft pages, you must also customize additional settings in the ACMP settings. To do this, navigate to System > Settings > ACMP Server > E-Mail Service.
Note:
Starting with ACMP version 6.5, the option to choose an authentication mode is no longer available. Authentication occurs automatically via the OAuth configuration.
Enter all the dates as shown in the following figure:
Server information for ACMP
Note:
You do not need to enable the two “Accept untrusted certificates” checkboxes under “Receive/Send Emails.”
When requesting the token, it is crucial that the email address and the user match so that the process works smoothly. The token is requested under the OAuth configuration section
To request the token, you must have selected “OAuth” under the password encryption setting. When requesting the token, you must enter the Application/Client ID and set the account type to “Microsoft Azure AD (organizations only).” At this point, you must insert the ID that you previously saved or copied. The username used here is taken from the Server information (sender).
Request a new authorization token
Make sure the token is created using the same email address that will be used to retrieve it. You used this email address in the email service settings. If a browser window does not open when creating the token, allowing you to select the Helpdesk user or email address, this is because Single Sign-On (SSO) is activated, which causes the token to be retrieved for the current Windows user. To resolve this issue, you must use a local Windows user who cannot execute SSO, or log in to Windows using the “Helpdeskuser”/email address that should also retrieve emails.
Log in to your account
Note:
Another option is to start the ACMP Console as a local user.
Changes to the AAD or Exchange settings
If you need to change settings in Azure Active Directory or the Online Exchange mailbox—such as two-factor authentication - it may take several minutes for the change to synchronize across all servers in AAD. In this case, you should wait a moment before retrieving a new token from ACMP.
Two-Factor Authentication
If you have activated two-factor authentication, you must disable it in order to retrieve emails using ACMP.
Shared Mailboxes
Currently, shared mailboxes can only be used if the mailbox has an Outlook/Exchange license (e.g., “Microsoft 365 E3”) and a password. Only then can the token be retrieved and emails be accessed.