Skip to main content

​
Overview

This guide walks you through configuring your Microsoft Entra tenant to allow Airia to access a designated service mailbox using a secure OAuth flow. No browser-based login is required — Airia authenticates directly using an app registration and client secret.

​
Prerequisites

Before you begin, ensure you have:
  • Azure admin access - An account with Global Administrator or Application Administrator role
  • Exchange Online PowerShell access - Required for the mailbox access policy step
  • Service mailbox - A designated service mailbox that Airia will read from (e.g., airia-service@yourcompany.com)

​
Step 1: Create an App Registration

  1. Go to the Microsoft Entra admin center and sign in with your admin account
  2. In the left nav, go to Applications → App registrations
App registrations page with New registration button
  1. Click + New registration
  2. Fill in the following:
    • Name: Airia Service Account (or any descriptive name)
    • Supported account types: Accounts in this organizational directory only (Single tenant)
    • Redirect URI: Leave blank
  3. Click Register
Once registered, you’ll land on the app overview page. Save the following values — you’ll need them for Airia configuration:
  • Application (client) ID
  • Directory (tenant) ID

​
Step 2: Create a Client Secret

  1. In the left nav under Manage, click Certificates & secrets
  2. Click + New client secret
  3. Give it a description (e.g., Airia secret) and set an expiry (24 months recommended)
  4. Click Add
  5. Immediately copy the Value
Secret VisibilityAzure will never show the secret value again after you leave this page. Treat this secret like a password and share it with Airia securely (e.g., via an encrypted channel, not plain email).

​
Step 3: Add API Permissions

  1. In the left nav under Manage, click API permissions
  2. Click + Add a permission
  3. Select Microsoft Graph
  4. Select Application permissions (not Delegated)
API permissions page

​
Required Permissions

Search for and add the permissions based on what you want Airia to do. You can refer to common permissions in the Microsoft Entra ID OAuth App Setup guide.
  1. Click Add permissions
  1. Click Grant admin consent for [your organization] and confirm
  2. All permissions should show a green checkmark with “Granted for [your org]” status

​
Step 4: Restrict Access to the Service Mailbox Only

Important Security StepBy default, Application-level permissions grant access to all mailboxes in your tenant. This step locks it down to only the designated service mailbox using an Exchange Application Access Policy.

​
1. Install Exchange Online PowerShell (if not already installed)

Install-Module -Name ExchangeOnlineManagement -Force
Import-Module ExchangeOnlineManagement

​
2. Connect to Exchange Online

Connect-ExchangeOnline
Sign in with your admin account when the browser prompt appears.
You must use an M365 organizational account, not a personal Microsoft account.

​
3. Create the Access Policy

Run the following command to restrict access: 
New-ApplicationAccessPolicy `
  -AppId <Application-Client-ID> `
  -PolicyScopeGroupId <service-mailbox@yourcompany.com> `
  -AccessRight RestrictAccess `
  -Description "Restrict Airia to service mailbox only"
Replace:
  • <Application-Client-ID> with the client ID from Step 1
  • <service-mailbox@yourcompany.com> with your designated service mailbox address

​
4. Verify the Policy

Test-ApplicationAccessPolicy `
  -AppId <Application-Client-ID> `
  -Identity <service-mailbox@yourcompany.com>
You should see AccessCheckResult: Granted. You can also confirm the app cannot access other mailboxes: 
Test-ApplicationAccessPolicy `
  -AppId <Application-Client-ID> `
  -Identity <any-other-user@yourcompany.com>
This should return AccessCheckResult: Denied.

​
Step 5: Share Credentials with Airia

Once setup is complete, securely provide Airia with the following configuration details:
FieldWhere to Find It
Tenant IDApp registration Overview page → Directory (tenant) ID
Client IDApp registration Overview page → Application (client) ID
Client SecretCopied in Step 2
Service Mailbox AddressThe mailbox you scoped the policy to

​
Next Steps

Once you have created and configured your Microsoft Entra Service Account, you can start using it to securely authenticate tools within Airia without requiring individual user logins.

​
Using Your Service Account

You can configure any OAuth-enabled Microsoft tool to use this Service Account:
  1. Navigate to the Tools section in your Airia platform
  2. Select the Microsoft tool you want to configure (e.g., Microsoft Graph Tools)
  3. When prompted for authentication details, select the OAuth connector you configured previously.
  4. The credential will now be obtained in the background, utilizing the restricted permissions you granted to access the resources you provided access to.

​
Additional Resources

  • [Microsoft Authentication Guide](/integrations/Tools/Microsoft\ Authentication): Learn more about different ways to authenticate Microsoft services in Airia.
  • Understanding MCP Servers: Discover how the Model Context Protocol enables seamless integrations between your AI agents and enterprise tools.