Custom Application Within Azure Portal

Introduction

Before you register your Microsoft 365 domain with Cohesity and protect Exchange Online data, ensure the following prerequisites are met:

1. Create a new user and configure the required roles for your Microsoft 365 user account. For more information, see User Roles and Application Permissions.
2. Custom Azure Application with the requisite permissions. For more information, see User Roles and Application Permissions.
3. You must open specific ports in the firewall to allow the Cohesity cluster to protect Microsoft 365 Exchange Online data. For information on the required ports, see Firewall and Port Requirements.
4. Review and understand the Considerations and Best Practices.

Register Custom Application on Azure Portal

Register a custom app on the Azure portal for Cohesity to connect with your Microsoft 365 account. You can also refer to the following topics on the Microsoft Docs portal for the latest procedure to register a custom app:

1. Create a custom application; see Register an application with the Microsoft identity platform topic on Microsoft Docs Portal.
2. Configure API access and assign appropriate permissions; see Configure a client application to access web APIs topic on Microsoft Docs Portal.

Register the Custom Application

Perform the following steps if you register an app for the first time.

To register an app on Azure Portal:

1. Log in to the Azure Portal with your Microsoft 365 administrator user credentials.
2. Search for and select Azure Active Directory.
3. Select App Registrations > New Registration.
4. Enter a Name for your app, select the Supported account types that can access the app, and enter https://localhost as the Redirect URI. Click Register.
5. On the RegisteredApp page, click Overview and copy the Application (client) ID. You need to use this ID to register Microsoft 365 as a source on Cohesity.
6. If the Microsoft 365 source tenant has OAuth enabled for secure communication, perform these additional steps:
   1. Click API permissions > Add a permission > APIs my organization uses.
   2. Search for and click Office 365 Exchange Online (Use the complete app name.)
   3. Click Application Permissions.
   4. Under Other Permissions, select full_access_as_app to enable OAuth and click Add Permissions.
   5. After adding the permissions, click Grant Admin Consent and click Yes to confirm.
7. On the same page, select API permissions > Add a permission > Microsoft Graph API.
8. Click Application Permissions, add the required App Permissions, and click Add permissions.
9. Again, on the same page, select API permissions > Add a permission >  APIs my organization uses > Office 365 SharePoint Online.
10. Click Application Permissions, add the required App Permissions, and click Add permissions.
11. Under Grant Consent, click Grant admin consent for <domain_name>.
12. Under App Registration, click the application name that you entered previously.
13. Next, you need to add a new client secret (or “App Secret Key”) that the app can use to prove its identity when requesting a token. Click Certificates & Secret > New client secret.
14. Enter a Description, select Never under Expires, and click Add.
15. Under Client secrets, click the Copy button next to the string under Value.
    

Configure Tenant Permissions

After registering the custom app, configure the tenant permissions on the custom app.

Custom Scripts are needed for recovering the SharePoint Online sites to the Microsoft 365 tenant or alternate Microsoft 365 tenant.

1. Launch the SharePoint Admin Center using the URL: https://your-tenant-admin.sharepoint.com/_layouts/15/AppInv.aspx
2. Enter the App ID field's AppID of the custom app you have created. Click Lookup to search for the custom app.
3. In the App Domain: field, enter www.localhost.com.
4. In the Permission Request XML field, enter:

<AppPermissionRequests AllowAppOnlyPolicy="true">
 <AppPermissionRequest Scope="http://sharepoint/content/tenant" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/list" Right="FullControl" />
 <AppPermissionRequest Scope="http://sharepoint/taxonomy" Right="Read,Write" />
</AppPermissionRequests>

5. Click create.
6. In the Do you trust <app_title>? page, click Trust It.

For recovering sites to the Microsoft 365 tenant or an alternate Microsoft 365 tenant, you also need to configure the following recovery permissions on the tenant:

1. Launch the tenant settings using the following URL: https://your-tenant-admin.sharepoint.com/_layouts/15/online/TenantSettings.aspx
2. Under Custom Scripts, enable: (scroll down to the bottom of the page)
   1. Allow users to run custom scripts on personal sites.
   2. Allow users to run custom scripts on self-service-created sites.
3. Click OK.

Get-Module -Name Microsoft.Online.SharePoint.PowerShell -ListAvailable | Select Name,Version
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Scope AllUsers

Connect-SPOService -Url 'https://<tenant>-admin.sharepoint.com'

Set-SPOTenant -DisableCustomAppAuthentication $False