Open Authentication (aka OAuth) is an open-standard authorization protocol that simplifies the SAML SSO approach without needing a third-party service. This article will walk you through configuring OAuth with Microsoft 365 and VIPRE Email Archiving.

Step 1: Log in to VIPRE Email Archiving

1. Log in to VIPRE Email Archiving as an Administrator
2. Navigate to Settings > Authentication and click Add Connection
3. For Preferred Connection type, next to Microsoft Entra, select Setup
4. You will be presented with two options:
   1. Setup Automated Onboarding (Preferred method)
   2. Manual Onboarding (Continue following the guide below)

5. Log in to your organization's Microsoft 365 subscription using an account with administrative access 
6. Navigate to the long menu to find the link to Entra ID
7. Open the Entra ID App Registrations 
   1. Any existing applications will be listed here, and there are 2 key areas - App registrations list / Add new registration and Endpoints
      • You may already have an application that is being used for OAuth / SSO purposes; you can edit this for VIPRE Email Archiving if you prefer, rather than adding a new application; however, we will show you here how to add a new registration
   2. Create an App:
      1. Click Add > App registration 
         1. Name (any name will do)
         2. Supported account types: Single tenant only - <tenant name>
         3. Redirect URI: Web
            1. Locate the Redirect URI within the VIPRE Email Archiving admin console by navigating to Settings > Authentication > Microsoft Entra and copy the Provider Configuration
            2. Go back to Microsoft Entra and paste the Provider Configuration into the text field next to Web

8. Click Register

9. Copy Application (client) ID (as seen in the Entra screenshot in step 8) to the VIPRE archive Client ID (as seen in the Email Archiving screenshot in step 7)
10. Copy Directory (tenant) ID (as seen in the Entra screenshot in step 8) to the VIPRE archive tenant ID (as seen in the Email Archiving screenshot in step 7)
11. Click on "Certificates & secrets" 
12. Click on "New client secret"
    1. Description: "VIPRE Archive"
    2. Expires: "730 days (24 months)" (Max is 24 months, we recommend that it expires with the rest of your client secrets so you can update them all at once)
13. Click on "Add"
14. You will now be presented with a new window that contains your Client secret; copy the Value to VIPRE Archive Client secret (as seen in the Email Archiving screenshot in step 7)
15. Secret Keys are only displayed on-screen once, so it is extremely important that you record this immediately. Enter a name for the key to your preference, then set the duration for the key

16. Navigate to Manage > API Permissions to ensure the following Microsoft Graph delegated permissions are granted
17. Click +Add a permission

18. Under Select an API, choose Microsoft Graph

19. Under What type of permissions does your application require? select Delegated permissions

20. Add the following: 
    • User.Read (The user.read permission is needed for functionality; this is the default setting for all new apps and does not need to be altered for VIPRE Email Archiving)
    • email
    • profile
    • openid
21. Click on "Grant admin consent for <tenant name>

After a successful login, VIPRE Email Archiving will connect to the Microsoft Graph API, passing the user credentials returned from OAuth to obtain essential details about the user, such as:
 

• Secondary email addresses
• First and last name
• Account creation date
• UPN (User Principal Name)
• GUID (Globally unique identifier)
   

Please note that the Graph API may be used to obtain data from Entra ID in the same way that LDAP was used for on-premise services and is not only used for Active Directory (AD).Ensure that the Staff Members are set with users existing in your AD to authenticate with. In Staff Members you will add any admins you wish to have for the archive and assign the permissions, and this will complete the setup.

5. Secret Key Creation 
   • It's important that a remote application can acknowledge an encrypted message sent from the OAuth provider (in this case, Entra ID) by decrypting it via a secret key; without this, it will not be allowed
   • Secret Keys are only displayed on-screen once, so it is extremely important that you record this immediately
   • Enter a name for the key – any name will do - then set the duration for the key
6. Reply URLs
   • OAuth’s security is ensured by the Entra ID only responding to requests coming from Web addresses that have been registered - the Reply URLs; you may only need one URL - the one added when you created above in step 2.b.iii, ending in “/microsoftoath.do”
7. Required Permissions
   1. During and after VIPRE Email Archiving > OAuth > Entra ID completes its verification steps, you can control who/where/how the login phases will be conducted, if Multifactor Authentication is to be used for certain user types, or depending on their location.
   2. After a successful login, VIPRE Email Archiving will connect to the Microsoft Graph API, passing the user credentials returned from OAuth to obtain essential details about the user, such as:
      • Secondary email addresses
      • First and last name
      • Account creation date
      • UPN (User Principal Name)
      • GUID (Globally unique identifier)
   3. The User Account “read” permission must be granted; this is the default setting for all new apps and does not need to be altered for VIPRE Email Archiving
   4. Please note that the Graph API may be used to obtain data from Entra ID in the same way that LDAP was used for on-premise services and is not only used for Active Directory
8. Endpoints
   1. When logging in, VIPRE Email Archiving needs to know where to redirect the user to perform the OAuth sequence and where to obtain the user's account details; these are known as endpoints and are web service URLs
   2. If you have set up an Entra ID-hosted developer application, these are common, fixed URLs and can be left blank on the VIPRE Email Archiving side; however, for the app registration described in this article, we will need to obtain 3 specific endpoints
      1. Endpoints are defined for your organization's Microsoft 365 subscription, not per app registration, so you will need to navigate back to the list of App Registrations panel; at the top, you will see the link to Endpoints
   3. The final 3 entries in the Endpoints list that are needed by VIPRE Email Archiving are OAuth 2 Authorization Endpoint, OAuth 2 Token Endpoint, and Graph API Endpoint
   4. That is all you need from the Microsoft 365 / Entra ID / OAuth side. Now, we can take the values highlighted in these steps and register them in VIPRE Email Archiving

Step 2: Set up OAuth in VIPRE Email Archiving

1. Log in to VIPRE Email Archiving as an Administrator
   1. Under the Adv. Configuration menu, you will see SSO OAuth
   2. Click Create New Connection
      1. Each entry added here will create an OAuth Login button on the Login page
      2. Use a name that your users may understand
      3. The remaining five entries are obtained from the Entra ID sections shown earlier in this document:
         1. Provider Type is Microsoft 365
         2. Client ID is the Azure app registration’s Application ID
         3. Client Secret is the key value that was displayed when you created the key
         4. Authorization URL is the OAuth 2 Authorization Endpoint (mentioned in step 6.c above)
         5. Access Token URL is the OAuth 2 Token Endpoint (mentioned in step 6.c above)
         6. User Detail URL is the Graph API Endpoint (mentioned in step 6.c above)

Once this connection is added, it will immediately appear on the VIPRE Email Archiving login panel.