This article applies as of PRTG 22

Important: If you want to use the Microsoft 365 Service Status sensor or the Microsoft 365 Service Status Advanced sensor, see How do I obtain credentials and set permissions for the Microsoft 365 Service Status sensors?

Credentials for Microsoft 365 and permissions for Microsoft Graph

Before you can set up the Microsoft 365 Mailbox sensor, you need to define credentials for Microsoft 365 in the settings of a parent object.

The credentials you need are the Tenant ID, the Client ID, and the Client Secret. You obtain the credentials in the Microsoft Azure Portal or through the Microsoft Entra admin center. There you can also set the permission that the Microsoft 365 Mailbox sensor requires to read data from Microsoft Graph.

The following step-by-step guide shows you how to obtain the necessary credentials and how to set the required API permission.

Log in to the Microsoft Azure Portal and follow the steps below:

• Step 1: Get the client ID and the tenant ID
• Step 2: Get the client secret
• Step 3: Set the permission for Microsoft Graph

Step 1: Get the client ID and the tenant ID

Take the following steps to register your application with Microsoft Entra ID to be assigned a client ID. You can use either the Azure Portal or the Microsoft Entra admin portal. The only difference is how you navigate to App registrations:

Using the Azure Portal: Open Microsoft Entra ID in the Microsoft Azure Portal and go to the App registrations tab.

Using the Microsoft Entra admin center: Go to the App registrations tab under Applications.

1. Click New registration to open the Register an application dialog.
   
   Click to enlarge.
2. Under Redirect URI (optional), select Web and enter the DNS name or IP address of your PRTG web server according to the following pattern: https://yourprtgserver/ms365.htm
   For more information, see the PRTG Manual: Microsoft 365 Mailbox sensor.
   
   Note: There are specific rules for the redirect URI.
   
   
   Click to enlarge.
3. Click Register to register the new application.
4. The Overview tab of the newly registered application opens.
5. Copy the Application (client) ID and the Directory (tenant) ID and enter them in the credentials for Microsoft 365 section in the settings of the device, group, or probe in or on which you plan to add the sensors.
   
   Click to enlarge.

Step 2: Get the client secret

Take the following steps to create an application password, also known as client secret.

1. Go to the Certificates & secrets tab.
2. Click New client secret to open the Add a client secret dialog.
   
   Click to enlarge.
   1. Enter a Description, for example, Microsoft 365 Client Secret.
   2. Select a period after which the client secret expires.
      Click to enlarge.
   3. Click Add to create and display the new client secret for your application.
      
      Click to enlarge.
3. Copy the client secret to enter it in the credentials for Microsoft 365 section of the object for which you already added the tenant ID and client ID.
   
   Important: Make sure that you directly copy the client secret after you created it. If you leave the page, the client secret is not shown anymore. You have to create a new client secret.

Step 3: Set the permission for Microsoft Graph

Take the following steps to set the required permission for the Microsoft 365 Mailbox sensor to be able to query data from Microsoft Graph.

1. Go to the API permissions tab.
2. Click Add a permission to open the Request API permissions dialog.
   
   Click to enlarge.
   1. Select the Microsoft Graph tile.
   2. Click Delegated permissions.
   3. Enable the check box next to the following permissions:
      • Mail.Read
      • Mail.Read.Shared
      • offline_access
      • User.Read
   4. Click Add permissions to add the required permission.

You can now create the Microsoft 365 Mailbox sensor.

More

• Redirect URI (reply URL) restrictions and limitations: https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url