Authentication- Redirect URI

The authorization server sends the code or token to the redirect URI, so it's important you register the correct location as part of the app registration process.

A Redirect URI, or reply URL,is the location where the Microsoft identity platform redirects a user's client and sends security tokens after authentication.

Follow these steps to add a Redirect URI:

1. In the Azure Portal, under Manage, select Authentication(from the left Menu)
2. Under Platform configuration, select Add a platform
3. Under Configure platforms, select Web Applications 
4. Enter the followingRedirect URI:

https://motionserverhost/api/cloudProviders/oauth2/microsoft/callback

(Replace "motionserverhost" with your motion server host value)

The Redirect URI will be needed during the Cloud Provider Configuration phase. 

Credentials- Client Secret

Credentials allow your application to authenticate as itself, requiring no interaction from a user at runtime.

Credentials are used by confidential client applications (apps that run on servers)that access a web API. Types of credentials areCertificates and Client secrets. Will will use Client Secrets.

A client secret is a secret string value your app can uses to prove its identity when requesting a token. Also can be referred to as application password.

Follow these steps to add a Client Secret:

1. In the Azure portal,under Manage, select Certificates & secrets(from the left Menu)
2. Select Client secrets>New client secret
3. Add a description for your client secret
4. Select an expiration for the secret or specify a custom lifetime
   • Client secret lifetime is limited to two years (24 months) or less. You can't specify a custom lifetime longer than 24 months
   • Microsoft recommends that you set an expiration value of less than 12 months
5. Select Add
6. Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.

The Client secret value will be needed during the Cloud Provider Configuration phase. 

API Permission

Let's see how to provide a client app registered with the Microsoft identity platform with permissions-based access to the web API and access to Microsoft Graph.

Client applications typically need to access resources in a web API. Applications are authorized to call APIs when they are granted permissions by users/admins as part of the consent process. The list of configured permissions should include all the permissions the application needs. 

Configure delegated permission to Microsoft Graph to enable your client application to perform operations on behalf of the logged-in user, for example reading their email or modifying their profile. By default, users of your client app are asked when they sign in to consent to the delegated permissions you've configured for it.

1. SelectAPI permissions>Add a permission>Microsoft Graph

2. SelectDelegated permissions. 

3. Add the following permissions:

   Permission	Description
   email	View users' email address
   offline_access	Maintain access to data you have given it access to
   openid	Sign users in
   profile	View users' basic profile
   IMAP.AccessAsUser.All	Read and write access to mailboxes via IMAP
   POP.AccessAsUser.All	Read and write access to mailboxes via POP
   SMTP.Send	Send emails from mailboxes using SMTP AUTH

4. Select Add permissionsto complete the process.

Whenever you configure permissions, users of your app are asked at sign-in for their consent to allow your app to access the resource API on their behalf.

For these permissions, it is not necessary to provide the consent of an Administrator, as indicated by the columnAdmin consent required. 

Cloud Provider Configuration

To use Modern Authentication to authenticate Email Accounts, you need to configure Microsoft Azure as service of the Cloud Provider on XCALLY.

Follow these steps to configure the Cloud Provider:

1. On XCALLY, under Settings, select Cloud Providers (from the left Menu)
2. Click on the button(on the lower right) and create a New Account
3. Enter the parameters of the application previously created in the Azure Portal: 
   1. Name: Enter a Name 
   2. Service: Select Microsoft Azure
   3. Type: Select Outlook365
   4. Application Id: Insert theApplication (client) ID value 
   5. Tenant Id: Insert theDirectory (tenant) ID value
   6. Client Secret: Insert theClient secret value
   7. Redirect URI: Insert theRedirect URI

Cloud Provider Account Authentication

With the use Modern Authentication, the Cloud Provider Account must be authenticated.  

Follow these steps to authenticate the Cloud Provider:

1. On XCALLY, under Settings, select Cloud Providers (from the left Menu)
2. Select the specific Cloud Provider Account, then click on thebutton
3. From the menu, select Authenticate

4. You will be redirected toMicrosoft Outlook365, where you insert yourEmail Credentials (Email address you will insert Email Address when creating a New Email Account, see next paragraph)and you need to accept theApp access authorization

5. The Authentication to the Microsoft Identity Platform will be notified on XCALLY

Cloud Provider association with the Email account

To use Modern Authentication for an Email Account, you need to associate the specific Email Account with the Cloud Provider using Microsoft Azure.

Follow these steps to configure the Cloud Provider:

1. On XCALLY, under Email, select Email Account (from the left Menu)
2. Click on the button(on the lower right) and create a New Email Account
3. Enter the parameters of the application previously created in the Azure Portal: 

• • Name: the name of the email account
  • Key:define a short name (5 character maximum) for the Account that will be shown on the Agents Tabs
  • Email Address:the origin email address of the messages (shown in the fromfield)
  • List: the default List where the new emailcontacts will be saved in the Contacts Manager, if it is not already there
  • Active: turn this flag on/off to activate/deactivate the Account
  • Service:SelectOutlook365
  • Modern Authentication: turn this flag on to activate Securityusing the following:

• • • Username:authentication username (Email Address you have previously entered)
    • Cloud Provider:Select the Cloud Provider previously created 
      
      
  • Description:an optional description of yourEmail Account

4. Click on Add Email Account

Client Secret Update 

Once generated, the Client Secret value is never displayed again neither in the Azure Portal nor on XCALLY.

To edit the Client Secret: 

• Generate a new Client Secret Value on the Azure Portal 
• Update the Client Secret Value on XCAlly: 
  1. On XCALLY, under Settings, select Cloud Providers (from the left Menu)
  2. Select the specific Cloud Provider Account, then click on thebutton
  3. From the menu, selectUpdate Client Secret
  4. Enter theNew Client Secretand then click onSave.