Exchange Protection Integration I: Exchange Online with Modern Authentication

Register Application

• Navigate to Azure Active Directory
• Select App registrations
• Press + New registration
• Enter as Name e.g. Silverback Exchange Online Connection
• Verify that Accounts in this organizational directory only (Your Organization only - Single tenant) is selected.
• Ensure that Redirect URI is set to Web and press Register

Assign Permission

• After successful registration, the details page of your registration should be opened
• Navigate to Manifest
  • Locate in the Manifest, the requiredResourceAccess
  • Replace your current resource AppID, id, and type with the following values
    • resource AppID = 00000002-0000-0ff1-ce00-000000000000
    • id: dc50a0fb-09a3-484d-be87-e023b12c6440
    • type: Role
  • Your Manifest should look like in the screenshot below
  • Press Save 

• Navigate to API Permissions
  • Verify that  the value Exchange.ManageAsApp is shown
  • Press Grant admin consent for Your Organization
  • Confirm with Yes
• Navigate to  Overview and note down your Application ID, e.g. in Notepad++
  • e.g.  e9e621e9-cc90-4b48-a9d4-43ee7e6c4e4b

Generate a self-signed certificate

• Open PowerShell as an Administrator either on your local machine (cloud customers) or on your Silverback Server (on-premise customers)
• Adjust and run the following command to generate the certificate

$mycert = New-SelfSignedCertificate -DnsName "imagoverum.com" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter (Get-Date).AddYears(1) -KeySpec KeyExchange

• Open certlm.msc, navigate to Personal > Certificates and review your created certificate
• Perform a double-click on your certificate
• Select Details and note down your certificate thumbprint, e.g. 502ca2f6f74bc5ea7b21b6a18182da8209a4f266
• Press OK 
• Additional steps for On-Premise Customers only
  • Perform a right click on your certificate
  • Select All Tasks > Managed Private Keys
  • Press Add and add the Network Service
  • Uncheck Full Control and ensure that Read is allowed

Export Public Key

• Adjust and run the following command to export the certificate

$mycert | Export-PfxCertificate -FilePath C:\Certificates\ExchangeOnlineSilverback.pfx -Password $(ConvertTo-SecureString -String "Pa$$w0rd" -AsPlainText -Force)

• Open File Explorer and navigate to C:\Certificates to review the *.pfx file
• Adjust and run the following command to export the public key

$mycert | Export-Certificate -FilePath C:\Certificates\ExchangeOnlineSilverback.cer

• Review the exported *.cer file in the C:\Certificates location
• Additionally, you should have noted down now two custom values: 

Application (client) ID: e9e621e9-cc90-4b48-a9d4-43ee7e6c4e4b
Thumbprint: 502ca2f6f74bc5ea7b21b6a18182da8209a4f266

Attach certificate to Azure AD application

• Navigate back to your Azure Active Directory
• Inside your App registration, navigate to Certificates & secrets
• Select Certificates
• Press Upload certificate
• Press Select a File
• Navigate to your exported public key ExchangeOnlineSilverback.cer
• Select the *.cer file and click open or perform a double click
• Press Add

Assign Role

• Close the App registration view with clicking X on the upper right
• At your Azure Active Directory view, navigate to Roles and administrators
• Search for the Exchange Administrator role
• Press Exchange Administrator
• Press + Add assignments
• Under Select member(s), press No member selected to add a new member
• Search for your previously created App registration, e.g. Silverback Exchange Online Connection
• Select your App registration and press Select
• Enter a justification, e.g. Assign Roles for Silverback Exchange Protection
• Press Assign

Install EXO V2 Module

• Open an administrative PowerShell
• Run the following command 

Install-Module -Name ExchangeOnlineManagement

• Confirm all prompts about NuGet Provider, Untrusted Repository etc.
• Wait until the Installation is finished
• Open File Explorer and review the installation (version) under C:\Program Files\WindowsPowerShell\Modules\ExchangeOnlineManagement (optional)

Verify Connection

• Now run the following adjusted command

Connect-ExchangeOnline -CertificateThumbPrint "502ca2f6f74bc5ea7b21b6a18182da8209a4f266" -AppID "e9e621e9-cc90-4b48-a9d4-43ee7e6c4e4b" -Organization "imagoverum.onmicrosoft.com"

•  After a successful connection, additional cmdlets will be downloaded and it should look like this afterwards

• To check functionality adjust and run the following command

get-EXOMailbox -Identity "tim.tober@imagoverum.com"

Try Additional commands  

• Check the following commands to get familiar with the handling

Get-ActiveSyncOrganizationSettings | ft DefaultAccessLevel

Get-EXOMailboxStatistics -Identity username | fl

Get-EXOMobileDeviceStatistics -Mailbox username

Get-CASMailbox -Identity username | fl *ActiveSync*

Get-CASMailbox -Identity username | select {$_.ActiveSyncAllowedDeviceIDs}

Get-CASMailbox -Identity username | select {$_.ActiveSyncBlockedDeviceIDs}

Get-MobileDevice | select UserDisplayName,DeviceID,DeviceType,DeviceUserAgent,DeviceModel,Name

Get-MobileDevice -Filter {DeviceAccessState -eq 'Quarantined'}

Get-MobileDevice -Mailbox username -Filter {DeviceAccessState -eq 'Quarantined'}

Set-CASMailbox -Identity username –ActiveSyncAllowedDeviceIDs DeviceID

| Export-CSV C:\file.csv

Check for managed devices  

• Enroll a device and assign an Exchange Active Profile 
• Follow the configuration on your device as usual
• Check if you have access to emails, calendar and contacts
• Your newly enrolled device should now be allowed automatically
• Navigate back to your PowerShell and execute the following adjusted command

Get-CASMailbox -Identity username | fl *ActiveSync*

• The device should be part of the ActiveSyncAllowedDeviceIDs list 

Check for restricted devices   

• Use a different unenrolled device
• On the device, add your Exchange ActiveSync account manually 
  • For iOS and iPadOS devices,
    • Open Settings 
    • Navigate to Passwords & Accounts
    • Tab Add Account
    • Select Microsoft Exchange
    • Finish your configuration
  • For Android and Samsung devices
    • Open Gmail 
    • Tab on your current account
    • Choose Add another account
    • Select Exchange and Office 365
    • Finish your configuration
• Your unenrolled device should now be quarantined automatically
• Navigate back to your PowerShell and execute the following adjusted command

Get-MobileDevice -Mailbox username -Filter {DeviceAccessState -eq 'Quarantined'}

• Your device should be listed here