Overview
This article explains how to configure App-Only Authentication for ReportEx using Microsoft Entra ID (Azure AD). The configuration includes:
Note: You must sign in with a Global Administrator, Application Administrator, or Privileged Role Administrator account, depending on the step being performed.
Step 1: Create an App Registration
- Sign in to the Microsoft Entra admin center:
https://entra.microsoft.com/
- Navigate to:
Identity → Applications → App registrations
- Click New registration.
- Enter a name for the application (for example, ReportEx).
- Under Supported account types, select:
Accounts in this organizational directory only (Single tenant)
- Leave the Redirect URI field empty. It is not required for certificate-based App-Only authentication.
- Click Register.
- After the application is created, copy the following information:
- Application (Client) ID
- This will be used in the Client ID field while creating the ReportEx instance.
- Tenant Domain
- Example:
contoso.onmicrosoft.com - This will be used in the Tenant Name field.
Step 2: Assign Exchange Online and Microsoft Graph API Permissions
A. Assign Exchange Online API Permission
Open the App Registration created in Step 1.
- Navigate to:
API Permissions → Add a permission
- Select:
APIs my organization uses
- Search for:
Office 365 Exchange Online
- Select Application permissions (Do not select Delegated permissions).
- Search for and enable the following permission:
Exchange.ManageAsApp
- Click Add permissions.
- After the permission has been added, click:
Grant admin consent for <Your Tenant>
- Confirm the action.
- Verify that the permission shows a green check mark indicating that Admin Consent has been granted.
B. Assign Microsoft Graph API Permissions
- From the same App Registration, navigate to:
API Permissions → Add a permission
- Select:
Microsoft Graph
- Select:
Application permissions
Do not select Delegated permissions.
- Search for and add the following permissions:
- After adding all the required permissions, verify that the following Application permissionsare listed:
- Office 365 Exchange Online
- Microsoft Graph
- User.Read.All
- Group.Read.All
- Reports.Read.All
- Organization.Read.All
- Click:
Grant admin consent for <Your Tenant>
- Confirm the action.
- Verify that the permissions show a green check mark, indicating that Admin Consent has been granted.
Important: Admin consent must be granted for all the required API permissions before configuring the ReportEx Exchange Online instance.
Step 3: Assign the Exchange Administrator Role
Important
The Exchange Administrator role must be assigned to the application from the Microsoft Entra admin center.
This role assignment cannot be completed from ReportEx or by a standard user account.
The role assignment must be performed by a Global Administrator or Privileged Role Administrator.
- Sign in to the Microsoft Entra admin center.
- Navigate to:
Identity → Roles & admins
- Search for:
Exchange Administrator
- Open the Exchange Administrator role.
- Select the Assignments tab.
- Click + Add assignments.
- Search for the application created in Step 1 (for example, ReportEx).
- The application will appear as a Service Principal.
- Select the application and click Add.
- Verify that the assignment appears with:
- Type: Service Principal
- Scope: Directory
Note
Role propagation may take several minutes.
If the ReportEx connection test fails immediately after assigning the role, wait a few minutes and test the connection again.
If certain reports later return permission-related errors, your administrator can verify that the application has the required Exchange Administrator role and API permissions.
Information Required in ReportEx
After completing the above configuration, use the following values while creating the Exchange Online instance in ReportEx.
ReportEx Field | Value |
Client ID | Application (Client) ID from the App Registration |
Tenant Name | Your tenant domain (for example, contoso.onmicrosoft.com) |
Need Assistance?
If you experience any issues while configuring Exchange Online for ReportEx, please contact the Hosting Controller Support Team.