Setting Up Microsoft Entra Service Account with a service mailbox

Overview

This guide walks you through configuring your Microsoft Entra tenant to allow Airia to access a designated service mailbox using a secure OAuth flow. No browser-based login is required — Airia authenticates directly using an app registration and client secret.

Prerequisites

Before you begin, ensure you have:

• Azure admin access - An account with Global Administrator or Application Administrator role
• Exchange Online PowerShell access - Required for the mailbox access policy step
• Service mailbox - A designated service mailbox that Airia will read from (e.g., [email protected])

Step 1: Create an App Registration

1. Go to the Microsoft Entra admin center and sign in with your admin account
2. In the left nav, go to Applications → App registrations

3. Click + New registration
4. Fill in the following:
   • Name: Airia Service Account (or any descriptive name)
   • Supported account types: Accounts in this organizational directory only (Single tenant)
   • Redirect URI: Leave blank
5. Click Register

Once registered, you'll land on the app overview page. Save the following values — you'll need them for Airia configuration:

• Application (client) ID
• Directory (tenant) ID

Step 2: Create a Client Secret

1. In the left nav under Manage, click Certificates & secrets
2. Click + New client secret
3. Give it a description (e.g., Airia secret) and set an expiry (24 months recommended)
4. Click Add
5. Immediately copy the Value

Step 3: Add API Permissions

1. In the left nav under Manage, click API permissions
2. Click + Add a permission
3. Select Microsoft Graph
4. Select Application permissions (not Delegated)

Required Permissions

Search for and add the permissions based on what you want Airia to do. You can refer to common permissions in the Microsoft Entra ID OAuth App Setup guide.

5. Click Add permissions

Grant Admin Consent

1. Click Grant admin consent for [your organization] and confirm
2. All permissions should show a green checkmark with "Granted for [your org]" status

Step 4: Restrict Access to the Service Mailbox Only

1. Install Exchange Online PowerShell (if not already installed)

Install-Module -Name ExchangeOnlineManagement -Force
Import-Module ExchangeOnlineManagement

2. Connect to Exchange Online

Connect-ExchangeOnline

Sign in with your admin account when the browser prompt appears.

3. Create the Access Policy

Run the following command to restrict access:

New-ApplicationAccessPolicy `
  -AppId <Application-Client-ID> `
  -PolicyScopeGroupId <service-[email protected]> `
  -AccessRight RestrictAccess `
  -Description "Restrict Airia to service mailbox only"

Replace:

• <Application-Client-ID> with the client ID from Step 1
• <[email protected]> with your designated service mailbox address

4. Verify the Policy

Test-ApplicationAccessPolicy `
  -AppId <Application-Client-ID> `
  -Identity <service-[email protected]>

You should see AccessCheckResult: Granted.

You can also confirm the app cannot access other mailboxes:

Test-ApplicationAccessPolicy `
  -AppId <Application-Client-ID> `
  -Identity <any-other-[email protected]>

This should return AccessCheckResult: Denied.

Step 5: Configure Service Account in Airia

With your credentials gathered, you can now configure the Service Account in your Airia platform:

1. Log in to your Airia platform as an administrator
2. Navigate to Settings → Ecosystem → App Connections → Microsoft
3. Select the Service Account authentication method
4. Enter the credentials you gathered in the previous steps:
   • Tenant ID: The Directory (tenant) ID from the app overview
   • Client ID: The Application (client) ID from the app overview
   • Client Secret: The secret value you copied in Step 2

Step 6: Use the Service Account with Microsoft Graph MCP

Once configured, you can use this Service Account to power Microsoft tools via an MCP Server:

1. Set up a new Microsoft Graph MCP server in your Airia platform
2. During setup, select the Microsoft Service Account connection you just configured, then save it
3. Create a new Agent and attach this Microsoft Graph MCP server to it
4. Based on the scopes and roles you assigned, the agent will automatically discover and display the available Microsoft Graph tools