Microsoft Entra ID Setup Guide

Configure your Microsoft 365 tenant so Axia can monitor Outlook emails and Teams messages for DLP analysis.

What you'll have at the end

Four values from your Microsoft Entra ID configuration that the Axia team needs to connect to your tenant: Directory (tenant) ID, Application (client) ID, Client Secret Value, and your Primary domain.

Prerequisites

1 Register the Application

  1. Sign in to the Azure Portal.
  2. Navigate to Microsoft Entra ID > App registrations.
  3. Click + New registration.
  4. Fill in the form:
    • Name: Axia Security
    • Supported account types: Accounts in this organizational directory only (Single tenant)
    • Redirect URI: Leave blank
  5. Click Register.

After registration, copy these values from the Overview page:

Value to copyWhere to find it
Application (client) IDOverview page, top section
Directory (tenant) IDOverview page, top section

2 Create a Client Secret

  1. In the app registration, go to Certificates & secrets > Client secrets.
  2. Click + New client secret.
  3. Enter a description (e.g., Axia production) and choose an expiry (recommended: 24 months).
  4. Click Add.
  5. Immediately copy the Value column.
Value to copy
Secret Value (the long string — not the Secret ID)
Important

Copy the Value, not the Secret ID. The Secret ID is a UUID that identifies the secret — it cannot be used for authentication. The Value is only shown once.

3 Grant API Permissions

Axia uses Microsoft Graph API with application permissions (no user sign-in required).

  1. In the app registration, go to API permissions.
  2. Click + Add a permission > Microsoft Graph > Application permissions.
  3. Add the permissions listed below based on which connectors you enable.

Required for Outlook email monitoring

PermissionPurpose
Mail.ReadRead emails from monitored mailboxes
User.Read.AllResolve user IDs and email addresses

Required for Teams message monitoring (if enabled)

PermissionPurpose
ChannelMessage.Read.AllRead messages from Teams channels
Chat.Read.AllRead messages from 1:1 and group chats
User.Read.AllResolve user IDs and display names

Required for OneDrive/SharePoint file scanning (if enabled)

PermissionPurpose
Files.Read.AllDownload files shared via OneDrive/SharePoint links in emails
  1. After adding all needed permissions, click Grant admin consent for [Your Organization].
  2. Confirm by clicking Yes.
  3. Verify that every permission shows a green checkmark under Status.
Admin consent is required

Without admin consent, the application will receive 403 Forbidden errors when calling the Graph API.

4 Identify Your Organization Domain

Axia uses the organization domain to distinguish internal recipients from external recipients. Only emails sent to external recipients are analyzed.

  1. In the Azure Portal, go to Microsoft Entra ID > Custom domain names.
  2. Look for the domain marked as Primary.
Value to copy
Primary domain (e.g., yourcompany.com)

5 Provide Credentials to Axia

Collect all the values from the previous steps and provide them to your Axia deployment team.

Values to provide

#ValueWhere you copied it fromExample
1Directory (tenant) IDStep 1 — App registration Overview pagea1b2c3d4-e5f6-7890-abcd-ef1234567890
2Application (client) IDStep 1 — App registration Overview page12345678-abcd-ef01-2345-6789abcdef01
3Client Secret ValueStep 2 — Certificates & secretsAbc8Q~xYz...
4Primary domainStep 4 — Custom domain namesyourcompany.com
Security

Share these values through a secure channel (e.g., a password manager or encrypted message). Never send them in plain-text email.

6 Set Up the Engagement Mailbox

Axia Security sends case emails (to the employee, manager, Legal or HR, and release requests) from this mailbox, and reads the replies that arrive in it. It uses its own app registration, never the credentials from Steps 1–3.

If your organization runs a DLP policy that quarantines mail (for example in Microsoft Purview), exclude this mailbox from it. A reply that quotes Axia Security's email can otherwise be quarantined before it arrives, and Axia Security never sees it.

  1. Create a dedicated mailbox for Axia Security (e.g., axia-review@yourcompany.com), not a person's mailbox and not a monitored user. Once saved, it is never scanned.
  2. Register a second application (e.g., Axia Engagement) and create a client secret for it, as in Steps 1–2.
  3. In its API permissions, add the application permissions Office 365 Exchange Online > SMTP.SendAsApp and Microsoft Graph > Mail.ReadWrite, then click Grant admin consent.
  4. In Exchange Online PowerShell, limit the application to that mailbox and turn on SMTP AUTH: 
    New-ServicePrincipal -AppId <client-id> -ObjectId <enterprise-app-object-id>
Add-MailboxPermission -Identity <mailbox> -User <client-id> -AccessRights FullAccess
Add-RecipientPermission -Identity <mailbox> -Trustee <client-id> -AccessRights SendAs
New-ApplicationAccessPolicy -AppId <client-id> -PolicyScopeGroupId <group-containing-the-mailbox> -AccessRight RestrictAccess
Set-CASMailbox -Identity <mailbox> -SmtpClientAuthenticationDisabled $false
  5. In Axia Security, the Engagement mailbox section appears on the Connect page right after you connect Microsoft 365 with Outlook selected; later, open it with Manage on the Microsoft Outlook card. Enter the Mailbox address, the Engagement app client ID and the Engagement app client secret, click Test, then Save mailbox (it tests again before saving).

Remove stops using the mailbox. Its address stays on the never-scan list, so its mail is never ingested as employee mail.

Verification Checklist