Overview
This article explains how to configure App-Only Authentication for ReportEx using Microsoft Entra ID (Azure AD). The configuration includes:
Note: You must sign in with a Global Administrator, Application Administrator, or Privileged Role Administrator account, depending on the step being performed.
Step 1: Create an App Registration
- Sign in to the Microsoft Entra admin center:
https://entra.microsoft.com/
- Navigate to:
Identity → Applications → App registrations
- Click New registration.
- Enter a name for the application (for example, ReportEx).
- Under Supported account types, select:
Accounts in this organizational directory only (Single tenant)
- Leave the Redirect URI field empty. It is not required for certificate-based App-Only authentication.
- Click Register.
- After the application is created, copy the following information:
- Application (Client) ID
- This will be used in the Client ID field while creating the ReportEx instance.
- Tenant Domain
- Example:
contoso.onmicrosoft.com - This will be used in the Tenant Name field.
Step 2: Assign Exchange Online API Permissions
- Open the App Registration created in Step 1.
- Navigate to:
API Permissions → Add a permission
- Select:
APIs my organization uses
- Search for:
Office 365 Exchange Online
- Select Application permissions (Do not select Delegated permissions).
- Search for and enable the following permission:
Exchange.ManageAsApp
- Click Add permissions.
- After the permission has been added, click:
Grant admin consent for <Your Tenant>
- Confirm the action.
- Verify that the permission shows a green check mark indicating that Admin Consent has been granted.
Step 3: Assign the Global Reader Role
Important
This step must be performed by a Global Administrator or Privileged Role Administrator.
The role assignment cannot be completed from ReportEx or by a standard user account.
- Sign in to the Microsoft Entra admin center.
- Navigate to:
Identity → Roles & admins
- Search for:
Global Reader
- Open the Global Reader role.
- Select the Assignments tab.
- Click + Add assignments.
- Search for the application created in Step 1 (for example, ReportEx).
- The application will appear as a Service Principal.
- Select the application and click Add.
- Verify that the assignment appears with:
- Type: Service Principal
- Scope: Directory
Note
Role propagation may take several minutes.
If the ReportEx connection test fails immediately after assigning the role, wait a few minutes and test the connection again.
If certain reports later return permission-related errors, your administrator can assign one of the following roles instead:
- Exchange Recipient Administrator
- Exchange Administrator
Information Required in ReportEx
After completing the above configuration, use the following values while creating the Exchange Online instance in ReportEx.
ReportEx Field | Value |
Client ID | Application (Client) ID from the App Registration |
Tenant Name | Your tenant domain (for example, contoso.onmicrosoft.com) |
Need Assistance?
If you experience any issues while configuring Exchange Online for ReportEx, please contact the Hosting Controller Support Team.