Configuring Microsoft Azure for Microsoft Graph API

Set up Microsoft Azure to let ServiceOps read your Exchange Online mailbox using the modern Microsoft Graph API, replacing the legacy Exchange Web Services (EWS) connection.

Microsoft Graph API is a unified REST API that provides access to Microsoft 365 data, including Exchange Online mailboxes. ServiceOps uses it to read incoming emails and convert them into tickets when the MAPI protocol and Microsoft Graph API connection type are selected.

SaaS Only

This guide applies to ServiceOps SaaS deployments only. On-Premises installations use Exchange Web Services (EWS). If you run On-Premises, refer to Configuring Microsoft Azure for OAuth instead.

How This Works

Microsoft is retiring Exchange Web Services (EWS) for Exchange Online on October 1, 2026. Microsoft Graph API is the replacement. Complete this setup before that date to avoid email-to-ticket disruption.

Setup requires two steps completed in order:

1. Azure setup (this guide): Register an app in Azure, add Graph API permissions, and restrict mailbox access. This step requires an Azure Global Administrator.
2. ServiceOps configuration: Return to Admin > Support Channel > Emails > Incoming Email Servers, add the server using Email Provider: Other, select Microsoft Graph API as the connection type, and paste the credentials from Step 1.

If the person configuring ServiceOps is not the Azure Global Administrator, share this guide with your Azure admin. Ask them to complete Step 1 and provide you with the Application (client) ID, Directory (tenant) ID, and Client Secret before you configure ServiceOps.

Prerequisites

Before starting, confirm the following:

• You have a ServiceOps SaaS deployment.
• You have Azure Global Administrator rights, or access to someone who does, to register an app and grant admin consent.
• The incoming email account is an Exchange Online or Office 365 mailbox.
• Your firewall allows outbound HTTPS (port 443) to login.microsoftonline.com and graph.microsoft.com.

Step 1: Set Up the Azure App Registration

Complete the following in the Microsoft Azure portal. If you need detailed instructions for any of these steps, refer to Register an application with the Microsoft identity platform.

1. Go to App registrations and click New registration.

2. Enter a name (for example, ServiceOps Graph API) and select Accounts in this organizational directory only. Leave Redirect URI blank.

3. Click Register and copy the Application (client) ID and Directory (tenant) ID from the app overview page.

4. Go to Manage > Certificates & secrets, click New client secret, and copy the Value immediately after creation. It won't be shown again.

5. Go to Manage > API Permissions, click Add a permission > Microsoft Graph > Application permissions, and add:

   Permission	Purpose
   Mail.Read	Lets ServiceOps read emails in the mailbox.
   Mail.ReadBasic.All	Lets ServiceOps read basic mail properties.

6. Click Grant admin consent for {your organization} and confirm all permissions show a green checkmark.

   Admin Rights Required

   The Grant admin consent button is visible only to Azure Global Administrators. Refer to Grant Tenant-wide admin consent to an application for details.

7. Restrict the app to access only the specific mailbox used in ServiceOps. Run the following in Exchange Online PowerShell, or follow the full guide at Limiting application permissions to specific Exchange Online mailboxes:

   New-ApplicationAccessPolicy `
     -AppId "<Application (client) ID>" `
     -PolicyScopeGroupId "<mailbox email address>" `
     -AccessRight RestrictAccess `
     -Description "Restrict ServiceOps Graph API access to one mailbox"

Step 2: Configure the Incoming Email Server in ServiceOps

Navigate to Admin > Support Channel > Emails > Incoming Email Servers and click Add Incoming Email Server.

Parameter	Value
Name	Enter a name to identify this server.
Email	Enter the Exchange Online mailbox address.
Protocol	Select MAPI.
Email Connection Type	Select Microsoft Graph API.
Email Provider	Select Other.
Server	outlook.office365.com
Security Type	Select SSL.
Email Auth Type	Select OAuth.
Client ID	Paste the Application (client) ID from Step 1.
Client Secret	Paste the client secret from Step 1.
Authorization URL	https://login.microsoftonline.com/{Tenant-ID}/oauth2/v2.0/authorize
Token URL	https://login.microsoftonline.com/{Tenant-ID}/oauth2/v2.0/token
Scope	https://graph.microsoft.com/.default
Technician Group	Select the group assigned to tickets created via this mailbox.
Category	Select the category assigned to tickets created via this mailbox.
Enabled	Toggle on.

Replace {Tenant-ID} in the Authorization URL and Token URL with the Directory (tenant) ID from Step 1.

Click Save, then click Test Connection from the server list page to verify the setup.

Troubleshooting

Common issues when configuring Microsoft Azure for Microsoft Graph API.

Test Connection fails after saving the server

Cause: The Azure App Registration is missing required Graph API permissions, or admin consent was not granted.

Fix:

1. Open the Azure App Registration and go to Manage > API Permissions.
2. Confirm Mail.Read and Mail.ReadBasic.All are listed as Application permissions with a green checkmark.
3. If the checkmark is missing, click Grant admin consent again.
4. Return to ServiceOps and click Test Connection.

Authentication fails with "invalid_client" or "unauthorized_client" error

Cause: The Client ID or Client Secret in ServiceOps does not match the Azure App Registration, or the secret has expired.

Fix:

1. Confirm the Application (client) ID in Azure matches the Client ID in ServiceOps.
2. Go to Manage > Certificates & secrets in Azure and check whether the secret has expired. Generate a new one if it has.
3. Update the Client Secret in the ServiceOps server configuration and save.
4. Click Test Connection to verify.

Emails are not converting into tickets after a successful Test Connection

Cause: The Application Access Policy may not include the correct mailbox, or Email to Ticket is disabled in ServiceOps.

Fix:

1. Confirm the New-ApplicationAccessPolicy command in Step 1 used the correct mailbox email address.
2. Navigate to Admin > Support Channel > Emails > Email Preference and confirm Email to Ticket is enabled.
3. Check Admin > Organization > Security > Operation Audit for Email Audit rejection reasons.

Scope field error when saving the server

Cause: An incorrect scope value was entered. Graph API application permissions require a specific scope format.

Fix: Set the Scope field to exactly https://graph.microsoft.com/.default. Do not use EWS or IMAP scope values here.

Related Topics

• Incoming Email Server
• Configuring Microsoft Azure for OAuth
• Configuring Admin Consent
• Outgoing Email Server
• Email Server Troubleshooting