Custom Application Within Azure Portal
  • 16 Jun 2023
  • Dark
    Light

Custom Application Within Azure Portal

  • Dark
    Light

Article Summary

Introduction

Before you register your Microsoft 365 domain with Cohesity and protect Exchange Online data, ensure the following prerequisites are met:

  1. Create a new user and configure the required roles for your Microsoft 365 user account. For more information, see User Roles and Application Permissions.
  2. Custom Azure Application with the requisite permissions. For more information, see User Roles and Application Permissions.
  3. You must open specific ports in the firewall to allow the Cohesity cluster to protect Microsoft 365 Exchange Online data. For information on the required ports, see Firewall and Port Requirements.
  4. Review and understand the Considerations and Best Practices.

While registering Microsoft 365 domain on Cohesity, ensure that you provide the user account details with all the specified roles. For more information, see Register Microsoft 365 Source Within Cohesity.

Register Custom Application on Azure Portal

Register a custom app on the Azure portal for Cohesity to connect with your Microsoft 365 account. You can also refer to the following topics on the Microsoft Docs portal for the latest procedure to register a custom app:

  1. Create a custom application; see Register an application with the Microsoft identity platform topic on Microsoft Docs Portal.
  2. Configure API access and assign appropriate permissions; see Configure a client application to access web APIs topic on Microsoft Docs Portal.

Ensure that you note down the app ID and access key while registering the custom app. The app ID and access key are required to register Microsoft 365 within Cohesity.

Register the Custom Application

Perform the following steps if you register an app for the first time.

If you have already registered an app within Cohesity to protect any supported Microsoft 365 applications, make sure that you edit the app and provide the required permissions.

To register an app on Azure Portal:

  1. Log in to the Azure Portal with your Microsoft 365 administrator user credentials.
  2. Search for and select Azure Active Directory.
  3. Select App Registrations > New Registration.
  4. Enter a Name for your app, select the Supported account types that can access the app, and enter https://localhost as the Redirect URI. Click Register.
  5. On the RegisteredApp page, click Overview and copy the Application (client) ID. You need to use this ID to register Microsoft 365 as a source on Cohesity.
  6. If the Microsoft 365 source tenant has OAuth enabled for secure communication, perform these additional steps:
    1. Click API permissions > Add a permission > APIs my organization uses.
    2. Search for and click Office 365 Exchange Online (Use the complete app name.)
    3. Click Application Permissions.
    4. Under Other Permissions, select full_access_as_app to enable OAuth and click Add Permissions.
    5. After adding the permissions, click Grant Admin Consent and click Yes to confirm.
  7. On the same page, select API permissions > Add a permission > Microsoft Graph API.
  8. Click Application Permissions, add the required App Permissions, and click Add permissions.
  9. Again, on the same page, select API permissions > Add a permission >  APIs my organization uses > Office 365 SharePoint Online.
  10. Click Application Permissions, add the required App Permissions, and click Add permissions.
  11. Under Grant Consent, click Grant admin consent for <domain_name>.
  12. Under App Registration, click the application name that you entered previously.
  13. Next, you need to add a new client secret (or “App Secret Key”) that the app can use to prove its identity when requesting a token. Click Certificates & Secret > New client secret.
  14. Enter a Description, select Never under Expires, and click Add.
  15. Under Client secrets, click the Copy button next to the string under Value.
    image.png

Save this value in a safe location. You need this value to register Microsoft 365 as a source in Cohesity.

Configure Tenant Permissions

After registering the custom app, configure the tenant permissions on the custom app.

Custom Scripts are needed for recovering the SharePoint Online sites to the Microsoft 365 tenant or alternate Microsoft 365 tenant.

  1. Launch the SharePoint Admin Center using the URL: https://your-tenant-admin.sharepoint.com/_layouts/15/AppInv.aspx
  2. Enter the App ID field's AppID of the custom app you have created. Click Lookup to search for the custom app.
  3. In the App Domain: field, enter www.localhost.com.
  4. In the Permission Request XML field, enter:
<AppPermissionRequests AllowAppOnlyPolicy="true">
 <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/taxonomy" Right="Read,Write" />
</AppPermissionRequests>
  1. Click create.
  2. In the Do you trust <app_title>? page, click Trust It.

For recovering sites to the Microsoft 365 tenant or an alternate Microsoft 365 tenant, you also need to configure the following recovery permissions on the tenant:

  1. Launch the tenant settings using the following URL: https://your-tenant-admin.sharepoint.com/_layouts/15/online/TenantSettings.aspx
  2. Under Custom Scripts, enable: (scroll down to the bottom of the page)
    1. Allow users to run custom scripts on personal sites.
    2. Allow users to run custom scripts on self-service-created sites.
  3. Click OK.

IMPORTANT: If you have created your Microsoft 365 tenant on or after Sep 20, 2020, you must install SharePoint Online PowerShell. Using the global administrator account, run the following commands in an administrator PowerShell session:

Get-Module -Name Microsoft.Online.SharePoint.PowerShell -ListAvailable | Select Name,Version
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Scope AllUsers

Connect-SPOService -Url 'https://<tenant>-admin.sharepoint.com'

Set-SPOTenant -DisableCustomAppAuthentication $False

Was this article helpful?