• Specify the application name and the account types the application must support.

• (Optional) Select the application type as Web and provide the URL where users can sign-in and use your email gateway.

• Mail.Read – Read mail in all mailboxes

• Mail. ReadWrite - Read and write mail in all mailboxes

• Mail.Send - Send mail as any user

• Generate a Client Secret of the application that you created on the Azure Management Portal.

  Note	Make sure that you copy the client secret value because it is not displayed during a subsequent login to the Azure Management portal.

• Update the application manifest with the key credentials from the public key certificate. Perform the following steps:

  1. Using a Windows PowerShell prompt, get the values for $base64Thumbprint , $base64Value , and $keyid from the public key certificate. See the example below. From the Windows PowerShell prompt, navigate to the directory containing the public key certificate and run the following:

     Example

     $cer = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
     $cer.Import(".\mycer.cer") 
     $bin = $cer.GetRawCertData() 
     $base64Value = [System.Convert]::ToBase64String($bin) 
     $bin = $cer.GetCertHash() 
     $base64Thumbprint = [System.Convert]::ToBase64String($bin) 
     $keyid = [System.Guid]::NewGuid().ToString()

     After running the above commands, run the following commands to extract their values:

     $keyid 
     $base64Value 
     $base64Thumbprint

  2. Click Manifest on left pane of the registered application pane to open the manifest of the application.

  3. In the manifest text editor, replace the empty KeyCredentials property with the following JSON:

     Example

     "keyCredentials": [
     {
     "customKeyIdentifier": "$base64Thumbprint_from_step_1",
     "keyId": "$keyid_from_step1",
     "type": "AsymmetricX509Cert",
     "usage": "Verify",
     "value": "$base64Value_from_step1"
     }
     ],

Example:

In the above JSON snippet, make sure that you replace the values of $base64Thumbprint , $base64Value, and $keyid with the values you obtained in step a. Each value must be entered in a single line

• Client ID

• Tenant ID. The Tenant ID is the unique value that will available on all the URLs listed on this page. For instance, the URLs listed on this page are:

  • https://login.microsoftonline.com/abcd1234-bcdd-469d-8545-a0662708cbc3/ federationmetadata/2007-06/federationmetadata.xml

  • https://login.microsoftonline.com/abcd1234-bcdd-469d-8545-a0662708cbc3/wsfed

  • https://login.microsoftonline.com/abcd1234-bcdd-469d-8545-a0662708cbc3/saml2

In this case, the Tenant ID is abcd1234-bcdd-469d-8545-a0662708cbc3 .

• Office 365/Hybrid (Graph API) – Select this to configure a mailbox deployed on Microsoft Exchange online and enter the following details:.

  • Client ID and Tenant ID of the application that you registered on the Azure Management Portal.

  • Select any one of the following methods to validate the client credentials:

    • Client Secret: Select this option and enter the Client Secret of the application that you generated on the Azure Management Portal.

    • Client Certificate: Select this option, enter the Thumbprint of the certificate (value of $base64Thumbprint ), and click Choose File to upload the private key of the certificate in the .pem format.

• Exchange On-premise - Select this to configure a mailbox deployed on Microsoft Exchange on-premise and enter the following details:

  • Enter the username and password of the user account with impersonator privileges. For more information, see Add a User to the Impersonator Role.

  • Enter the hostname of the Microsoft Exchange on-premise server.

    Note	If you are using a load balancer for a multi-tenant deployment, you must configure the hostname of your load balancer.

• Forward to an email address. Select this option to forward the message with malicious attachment to a specified user, for example, an email administrator.
• Delete the message. Select this option to permanently delete the message with malicious attachment from the end user’s mailbox.
• Forward to an email address and delete the message. Select this option to forward the message with malicious attachment to a specified user, for example, an email administrator and permanently delete that message from the end user’s mailbox.

• Enter a batch name for the remediation.
• Select anyone of the following remediation action:
  • Delete the messages. Select this option to permanently delete the malicious messages from the end user’s mailbox.
  • Forward to an email address or multiple email addresses separated by a semicolon(;). Select this option to forward the malicious messages to a specified user, for example, an email administrator.
  • Forward to an email address or multiple email addresses separated by a semicolon(;) and delete the messages. Select this option to forward the malicious messages to a specified user, for example, an email administrator and permanently delete that messages from the end user’s mailbox.