MS Exchange Online Email Connector Setup Guide

This guide explains how to configure the MS Exchange Email Connector for Microsoft 365/Exchange Online deployments. It covers Azure app registration, CCM channel setup, deployment variables, verification, and common troubleshooting points.

Who this is for: Platform administrators, DevOps engineers, and implementation teams configuring EMAIL channels in CCM for the MS Exchange Email Connector.

Overview

The connector supports two transport methods, depending on where the mailbox is hosted:

Deployment mode	Transport	Typical use case
`ONLINE`	Microsoft Graph using OAuth app-only authentication	Exchange Online / Microsoft 365
`OFFLINE`	Exchange Web Services (EWS) using basic authentication	On-premises Exchange Server

Each EMAIL channel must explicitly set DEPLOYMENT-MODE to either ONLINE or OFFLINE.

Key mapping rule: The EMAIL channel serviceIdentifier must match the USERNAME value in the provider configuration. In practice, both should be the mailbox SMTP address.

Prerequisites

Required for all deployments

CX tenant and CCM are running.
An EMAIL channel type exists in CCM.
The MS Exchange Email Connector is deployed.
The connector can reach CCM and File Engine.
Deployment-level environment variables are configured: CCM_URL, FILE_ENGINE_URL, and CX_TENANT_URL.

Additional requirements for ONLINE mode

A Microsoft 365 or Exchange Online mailbox exists for the channel.
You have access to Microsoft Entra ID to register an application.
You can grant admin consent, typically via Global Administrator or Privileged Role Administrator privileges.
The app registration is created in the same cloud as the mailbox tenant.

How the connector works

The connector reads channel-level configuration from CCM and then uses the transport that matches the configured mode.

CCM channel configuration → MS Exchange Email Connector → ONLINE via Microsoft Graph or OFFLINE via EWS

ONLINE
Uses Microsoft Graph with client credentials for Exchange Online mailboxes.

OFFLINE
Uses Exchange Web Services for on-premises Exchange environments.

Azure App Registration for ONLINE mode

Use these steps when configuring an Exchange Online or Microsoft 365 mailbox.

Create the app registration

Open https://entra.microsoft.com/.
Switch to the correct tenant and cloud.
Go to App registrations → New registration.

Field	Value
Name	`Expertflow MS Email Connector` or a customer-specific name
Supported account types	Accounts in this organizational directory only
Redirect URI	Leave blank for daemon/client-credentials flow

Capture the IDs and secret

After registration, copy the following values from the app overview page and store them in CCM:

Azure value	CCM key	Purpose
Application (client) ID	`GRAPH-CLIENT-ID`	Identifies the app registration
Directory (tenant) ID	`GRAPH-TENANT-ID`	Identifies the Entra tenant
Client secret value	`GRAPH-CLIENT-SECRET`	Used for app authentication

For GRAPH-CLIENT-SECRETgo to Certificates & secrets and add new client secret

Security: The client secret is shown only once. Store it securely in CCM or a secrets manager. Do not commit it to source control.

Grant Microsoft Graph permissions

Add Application permissions for Microsoft Graph, not Delegated permissions.

Permission	Why it is needed
`Mail.Read`	Reads inbound email from the mailbox inbox
`Mail.Send`	Sends outbound email
`Mail.ReadWrite`	Creates reply drafts for threaded replies using `createReply`

After adding permissions, grant admin consent for the tenant. All permissions should show as granted.

Recommended: Restrict the app to only approved mailboxes by applying an Exchange Application Access Policy.

National and sovereign cloud scope values

If the mailbox is hosted outside the commercial Microsoft cloud, set GRAPH-SCOPE to the matching environment.

Cloud	`GRAPH-SCOPE` value
Commercial	`https://graph.microsoft.com/.default`
US Government	`https://graph.microsoft.us/.default`
Germany	`https://graph.microsoft.de/.default`
China	`https://microsoftgraph.chinacloudapi.cn/.default`

CCM channel configuration

Create or edit an EMAIL channel in Unified Admin, set the mailbox SMTP address as the service identifier, attach the MS Exchange Email Connector, and fill in the provider configuration attributes.

For this user needs to create following attributes in channel provider and cinfigure the values while creating channel connector.

CCM key	Required	Description	Example
`DEPLOYMENT-MODE`	Yes	Sets the channel to Graph mode	`ONLINE`
`USERNAME`	Yes	Mailbox SMTP address; must equal service identifier	`agent@customer.onmicrosoft.com`
`DOMAIN-PART`	Yes	Used for outbound Message-ID generation	`customer.onmicrosoft.com`
`GRAPH-TENANT-ID`	Yes	Entra tenant ID	`1bd934b8-e1bd-43c3-8f8b-25f35ca69e29`
`GRAPH-CLIENT-ID`	Yes	Application client ID	`535fb089-9ff3-47b6-9bfb-4f1264799865`
`GRAPH-CLIENT-SECRET`	Yes	Client secret value	`(secret)`
`GRAPH-SCOPE`	Yes	Optional Graph scope or national cloud value	`https://graph.microsoft.com/.default`

If CCM schema still shows PASSWORD or EXCHANGE-URI as required for this mode, leave them empty unless CCM enforces a placeholder. The connector itself does not use them in ONLINE mode.

Example configurations

Example ONLINE channel

Service Identifier:  nadeem.abbas@expertflowllc.onmicrosoft.com

DEPLOYMENT-MODE:     ONLINE
USERNAME:            nadeem.abbas@expertflowllc.onmicrosoft.com
DOMAIN-PART:         expertflowllc.onmicrosoft.com
GRAPH-TENANT-ID:     1bd934b8-e1bd-43c3-8f8b-25f35ca69e29
GRAPH-CLIENT-ID:     <application-client-id>
GRAPH-CLIENT-SECRET: <client-secret>
GRAPH-SCOPE:         https://graph.microsoft.com/.default

Example OFFLINE channel

Service Identifier:  ef.agent2@efsupport.com

DEPLOYMENT-MODE:     OFFLINE
USERNAME:            ef.agent2@efsupport.com
PASSWORD:            <password>
EXCHANGE-URI:        https://exchange.company.com/EWS/Exchange.asmx
DOMAIN-PART:         efsupport.com

Deployment variables and validation

The following values are configured at deployment time in Helm, Kubernetes, or Docker. They are not CCM channel attributes.

Variable	Description
`CCM_URL`	CCM service base URL
`FILE_ENGINE_URL`	File Engine base URL
`CX_TENANT_URL`	CX Tenant service URL
`scheduler_fixed_rate_in_ms`	Polling interval, default `60000` milliseconds

Common issues and fixes

Symptom	Likely cause	Recommended action
`No channels found for tenant`	No EMAIL channel exists in CCM for that CX tenant	Create or attach the EMAIL channel in CCM
`One or more attributes are missing from Channel Provider Config`	Required keys are missing for the selected mode	Complete the channel provider configuration
`Selected Service Identifier ... is not same as ... Username`	`serviceIdentifier` and `USERNAME` do not match	Set both to the same mailbox address
Graph 401 or 403 errors	Missing Graph permissions or admin consent	Verify permissions and re-grant admin consent
Graph `createReply` fails	`Mail.ReadWrite` is missing	Add the permission and grant consent again
Cross-cloud authentication failure	App registered in the wrong Microsoft cloud	Register the app in the matching cloud and set `GRAPH-SCOPE`