How to register CodeTwo applications in Azure AD
Problem:
You want to manually register CodeTwo application in your Azure Active Directory tenant.
Solution:
CodeTwo Backup (starting version 2.3.x). CodeTwo Office 365 Migration / CodeTwo Exchange Migration (starting version 3.2.x) and the Sent Items Update service in CodeTwo Exchange Rules family of software (starting version x.14) connect to Microsoft 365 (Office 365) by using the secure OAuth 2.0 authorization protocol. To enable this connection, first you need to register the CodeTwo application in Azure AD for all Microsoft 365 tenants that will be used in your CodeTwo software. Next, to allow the CodeTwo application to access your data and perform the necessary tasks, you also need to grant the necessary permissions to that application.
Important
Keep in mind that CodeTwo software can perform the registration automatically. You simply need to provide a Microsoft 365 global admin credentials in server connection wizard. To learn more, see the user's manual:
CodeTwo Backup
CodeTwo Office 365 Migration
CodeTwo Exchange Migration
CodeTwo Exchange Rules Pro
- configuring the Sent Items Update service (in the case of hybrid environments only)
CodeTwo Exchange Rules
- configuring the Sent Items Update service (in the case of hybrid environments only)
Use the links below for guidelines on how to register the CodeTwo application in Azure AD:
- Register a new application in Azure AD
- Configure application permissions
- Assign certificates / secrets to an app in Azure
Registering a new application in Azure AD
- Sign in to the Microsoft Entra admin center.
- Navigate to Azure Active Directory (or Identity) > Applications > App registrations.
- Click New registration (Fig. 1.). This opens the Register an application page.
Fig. 1. The App registrations page in the Microsoft Entra admin center.
- Enter a name for the application (e.g. CodeTwo Migration app, if you are using one of CodeTwo’s migration tools) and click Register (Fig. 2.). You can leave the other options to their defaults.
Fig. 2. Registering the CodeTwo application with Azure AD.
Configuring application permissions
- On the application Overview page, click View API permissions (Fig. 3.). The API permissions page will open.
Fig. 3. Accessing the API permissions page.
- Click the Add a permission button and in the pane that opens click APIs my organization uses (Fig. 4.).
Fig. 4. Listing all APIs available for your organization.
- Enter Office 365 in the search box and select Office 365 Exchange Online (Fig. 5.).
Fig. 5. Finding the Exchange Online API.
- Click Application permissions, expand Other permissions, select full_access_as_app and then click Add permissions (Fig. 6.).
Fig. 6. Adding a new permission to an application in Azure AD.
- If you are registering a CodeTwo application that will be used with CodeTwo Exchange Rules family of products, skip directly to this step.
If you are registering a CodeTwo application that will be used with CodeTwo Backup and CodeTwo migration tools, click Add a permission again and this time select Microsoft Graph under Microsoft APIs. - Click Application permissions and select the permissions required by a specific CodeTwo application and server connection type:
CodeTwo Backup
If you are configuring a connection to Exchange Online, select:
- Directory > Directory.Read.All
- Group > Group.Read.All
- MailboxSettings > MailboxSettings.ReadWrite
- User > User.Read.All
If you are configuring a connection to SharePoint Online, select:
- Directory > Directory.Read.All
- Group > Group.Read.All
- User > User.Read.All
CodeTwo migration software
If you are configuring a connection to your source Microsoft 365 (Office 365) tenant, select:
- Directory > Directory.Read.All
- MailboxSettings > MailboxSettings.ReadWrite
- User > User.Read.All
If you are configuring a connection to your target Microsoft 365 (Office 365) tenant, select:
- Device > Device.ReadWrite.All
- Directory > Directory.Read.All
- Directory > Directory.ReadWrite.All
- MailboxSettings > MailboxSettings.ReadWrite
- User > User.Read.All
- User > User.ReadWrite.All
- Back on the API permissions page, click the Grant admin consent for <your organization name> button (once it becomes available) and then click Yes to confirm (Fig. 7.).
Fig. 7. Granting the necessary consents.
Assigning certificates / secrets in Azure AD
You need to assign a certificate or client secret (app password) to the newly added application. This will allow the OAuth protocol to prove the application’s identity. Follow the steps below to assign a certificate or add a client secret to the CodeTwo application registered in Azure AD.
- Navigate to Azure Active Directory > Applications > App registrationsand select the newly added application (in this example: CodeTwo Migration app).
- In the navigation menu, click Certificates & secrets (see Fig. 8.). Now, you need to assign either a certificate or client secret to the CodeTwo application.
- 3a To assign a certificate, click Certificates > Upload certificate, select your certificate file and click Add (Fig. 8.). The certificate needs to be signed with a key size of 2048 bits.
Fig. 8. Assigning a certificate in Azure AD.
- 3b To add a client secret, click Client secrets > New client secret, enter a short description (e.g. CodeTwo Migration app), select the expiration time (whichever suits your needs) from the drop-down menu, and click Add (Fig. 9.).
Fig. 9. Creating a new client secret for an application registered in Azure AD.
Important
Make sure to copy the client secret value to clipboard (Fig. 10.) or use it in your CodeTwo application straightaway, because once you refresh the page, you will not be able to view that value again. You will have to create another client secret.
Fig. 10. How to copy the client secret value to the clipboard.
Once done, the application registration process is completed. You can now configure a connection to Microsoft 365 (Office 365) in your CodeTwo software. All the information that you need to provide in the Application details step of the server connection wizard (Fig. 11.) is provided in Azure AD either on the application overview page (Application (client) ID and Directory (tenant) ID) or on the Certificates & secrets page (the Certificates or Client secrets tab).
Important
If you have used a certificate to identify an application, you can enter the Certificate thumbprint only if the certificate associated with the CodeTwo application has been added to the correct certificate store on the same machine, where the application is installed. If not, use the Import button to add the necessary certificate to that store.
Fig. 11. Providing the registration details in the target server connection wizard in CodeTwo Office 365 Migration.
For more information on how to configure server connections, refer to the user's manual:
To learn more about the Sent Items Update service in CodeTwo Exchange Rules, use the links below:
Related products: | CodeTwo Backup for Exchange, CodeTwo Backup for Office 365, CodeTwo Exchange Migration, CodeTwo Office 365 Migration |
Categories: | How-To |
Last modified: | July 14, 2023 |
Created: | January 27, 2020 |
ID: | 840 |