Enterprise Recon 2.3

Download ER 2.3 User Guide (PDF)

Exchange Online

This section covers the following topics:

Exchange Online

When Exchange Online is added as a scan Target, ER2 returns all Microsoft 365 groups and user accounts with active mailboxes in each group. You can select specific groups or individual users when setting up the scan schedule, and each group will be presented as a separate location for the Exchange Online Target.

Here are some scenarios which may benefit from scanning Exchange Online mailboxes by Microsoft 365 groups:

  • Users in the organization are typically managed as groups, and assigned group memberships in your Microsoft 365 environment.
  • Compliance procedures requires the capability to segregate and report scan results by business unit, division or group.
  • Head of Departments are only authorized to review and remediate non-compliant mailboxes in certain groups. This can be easily managed by delegating specific Resource Permissions to the user.

You can also scan all users with mailboxes in your organization's domain by adding the "All Users" group as a scan location.

Example of Exchange Online structure: Exchange Online [domain: example.onmicrosoft.com] +- Exchange Online on target EXCHANGEONLINE:EXAMPLE.ONMICROSOFT.COM +- Group All Users +- Group Engineering +- Group Design

Licensing

For Sitewide Licenses, all scanned Exchange Online Targets consume data from the Sitewide License data allowance limit.

For Non-Sitewide Licenses, Exchange Online Targets require Client Licenses, and consume data from the Client License data allowance limit.

See Target Licenses for more information.

Requirements

Requirements Description
Proxy Agent
  • Proxy Agent host with direct Internet access.
  • Cloud service-specific access keys.
  • ER 2.1 Agent and newer.
TCP Allowed Connections Port 443

Configure Microsoft 365 Account

For ER 2.1 and above, you will need to perform the following setup to scan Exchange Online Targets:

  1. Generate Client ID and Tenant ID Key
  2. Generate Client Secret Key
  3. Grant API Access

Generate Client ID and Tenant ID Key

  1. With your administrator account, log into the Azure app registration portal.
  2. In the App registrations page, click on + New registration.

  3. In the Register an application page, fill in the following fields:

    Field Description
    Name Enter a descriptive display name for ER2. For example, Enterprise Recon.
    Supported account types Select Accounts in this organizational directory only.
  4. Click Register. A dialog box appears, displaying the overview for the newly registered app, "Enterprise Recon".

  5. Take down the values for the Application (client) ID and Directory (tenant) ID. This will be required when you Set Up Exchange Online as a Target Location.

    Enterprise Recon app Overview in the Microsoft Azure app registration portal.

Generate Client Secret Key

  1. With your administrator account, log into the Azure app registration portal.
  2. In the App registrations page, go to the Owner applications tab. Click on the app that you registered when generating the Client ID and Tenant ID key. For example, "Enterprise Recon".
  3. In the Manage panel, click Certificates & secrets.
  4. In the Client secrets section, click + New client secret.

  5. In the Add a client secret page, fill in the following fields:

    Field Description
    Description Enter a descriptive label for the Client Secret key.
    Expires Select a validity period for the Client Secret key.
  6. Click Add. The Value column will contain the Client Secret key.
    Newly created Client Secret key for the Enterprise Recon app.

  7. Copy and save the Client Secret key to a secure location. This will be required when you Set Up Exchange Online as a Target Location.

Grant API Access

To scan Exchange Online Targets, you will need to grant ER2 permissions to access specific resource APIs.

  1. With your administrator account, log into the Azure app registration portal.
  2. In the App registrations page, go to the Owner applications tab. Click on the app that you registered when generating the Client ID and Tenant ID key. For example, "Enterprise Recon".
  3. In the Manage panel, click API permissions.
  4. In the Configured permissions section, click + Add a permission.
  5. In the Request API permissions page, select Microsoft Graph > Application permissions.

  6. Select the following permissions for the "Enterprise Recon" app:

    API Permissions Description
    • Group.Read.All
    • User.Read.All
    • Directory.Read.All
    • Mail.Read
    • Contacts.Read
    • Calendars.Read
    		 Required for probing and scanning Exchange Online Targets.
    • Group.ReadWrite.All
    • User.ReadWrite.All
    • Directory.ReadWrite.All
    • Mail.ReadWrite
    • Contacts.ReadWrite
    • Calendars.ReadWrite
    		 Required for remediating Exchange Online Targets.
  7. Click Add permissions.
  8. In the Configured permissions page, click on Grant admin consent for <organization name>.
  9. In the Permissions requested Accept for your organization window, click Accept. The Status column for all the newly added API permissions will be updated to "Granted for <organization name>".

Set Up Exchange Online as a Target Location

This section describes how to set up Exchange Online Targets for ER 2.1 and above.

  1. Configure Microsoft 365 Account.
  2. From the New Scan page, Add Targets.
  3. In the Select Target Type dialog box, select Microsoft 365 > Exchange Online.

  4. Fill in the following details:
    Dialog box to configure the path, credentials and proxy agent for an Exchange Online Targets

    Field Description
    Microsoft 365 Domain Enter your Microsoft 365 domain name.
    To scan the mailbox of a specific Microsoft 365 group or user account, see Edit Exchange Online Target Path.
    New Credential Label Enter a descriptive label for the credential set.
    Client ID Enter the Client ID. See Generate Client ID and Tenant ID Key for more information.
    Client Secret Enter the Client Secret key. See Generate Client Secret Key for more information.
    Tenant ID Enter the Tenant ID. See Generate Client ID and Tenant ID Key for more information.
    Agent to act as proxy host Select a Proxy Agent host with direct Internet access.
  5. Click Test. If ER2 can connect to the Target, the button changes to a Commit button.
  6. Click Commit to add the Target.
  7. Back in the New Scan page, locate the newly added Exchange Online Target and click on the arrow next to it to display a list of available Microsoft 365 groups for the domain.
  8. Select the Target location(s) to scan:

    1. If "All Users" is selected, ER2 scans all user accounts in the Microsoft 365 domain.

    2. If only specific groups are selected, ER2 only scans user accounts in the selected groups.

  9. Click Next to continue configuring your new scan.

Edit Exchange Online Target Path

  1. Set Up Exchange Online as a Target Location.
  2. In the Select Locations section, select your Exchange Online Target location and click Edit.
  3. In the Edit Exchange Online dialog box, enter a Path to scan. Use the following syntax:
    Mailbox / Folder to Scan Path
    All user accounts in a specific group

    Syntax: <Group Display Name>

    Example: Engineering (SG)
    Specific user account in group

    Syntax: <Group Display Name>/<User Principal Name>

    Example: Engineering (SG)/user1@example.com
    Specific folder for user account in group

    Syntax: <Group Display Name>/<User Principal Name>/<Mailbox Folder>

    Example: Engineering (SG)/user1@example.com/ProjectA
    All user accounts

    Syntax: All Users
    Specific user account
    Recommended for scanning mailboxes of user accounts that do not belong to any Microsoft 365 group.

    Syntax: All Users/<User Principal Name>

    Example: All Users/user1@example.com
    Specific folder for user account
    Recommended for scanning mailboxes of user accounts that do not belong to any Microsoft 365 group.

    Syntax: All Users/<User Principal Name>/<Mailbox Folder>

    Example: All Users/user1@example.com/ProjectA
  4. Click Test and then Commit to save the path to the Target location.

Unsupported Mailbox Types and Folders

ER2 currently does not support the following mailbox types and folders for the Exchange Online Target:

  • Archived mailboxes (In-Place Archives)
  • Disabled mailboxes
  • Deleted mailboxes
  • Inactive mailboxes
  • Shared mailboxes (unlicensed)
  • Microsoft 365 Group mailboxes and conversations

Mailbox in Multiple Groups

This section describes the behavior of mailboxes that are members of multiple groups for the Exchange Online Target.

License Consumption

A mailbox for a user account that belongs to multiple groups

  • is scanned each time a group the user belongs to is scanned.
  • consumes only 1x data allowance usage regardless of how many times it is scanned as part of different groups.

Scan Results

Matches that are found in mailboxes that belong to multiple groups will be reported as a distinct match count for each group.

Take for example a simplified Exchange Online Target for the domain "example.onmicrosoft.com" below:

EXAMPLE.ONMICROSOFT.COM 55 matches +– Engineering 30 matches +– UserA 10 matches +– UserB 20 matches +– Design 25 matches +– UserA 10 matches +– UserC 15 matches

Matches found in the mailbox for UserA will be included in the match count for both Engineering and Design groups.

Exchange Online (EWS)

Licensing

For Sitewide Licenses, all scanned Exchange Online (EWS) Targets consume data from the Sitewide License data allowance limit.

For Non-Sitewide Licenses, Exchange Online (EWS) Targets require Client Licenses, and consume data from the Client License data allowance limit.

See Target Licenses for more information.

Requirements

Requirements Description
Proxy Agent
  • Proxy Agent host with direct Internet access.
  • Cloud service-specific access keys.
TCP Allowed Connections Port 443

Enable Impersonation in Microsoft 365

To scan Exchange Online (EWS) Targets, use a service account assigned with the ApplicationImpersonation and Mailbox Search roles:

  1. Log into your Microsoft 365 global administrator account.
  2. Create a new service account for use with ER2.
  3. We need a custom admin role to assign the service account to. To create a custom admin role:
    1. Navigate to the Exchange admin center by going to ADMIN > Exchange.
    2. In the Exchange admin center, select permissions and go to the admin roles tab.
    3. In the roles tab, click +.
  4. This brings up the Role Group page. Configure the custom admin role:
    1. Under the Roles section, select the ApplicationImpersonation and Mailbox Search roles.
    2. Add the service account created in step 2 to the list of Members, or users that are assigned this custom admin role.
  5. Click Save.

Set Up Exchange Online (EWS) as a Target Location

  1. Enable Impersonation in Microsoft 365.
  2. From the New Scan page, Add Targets.
  3. In the Select Target Type dialog box, select Microsoft 365 > Exchange Online (EWS).

  4. Fill in the following details:
    Dialog box to configure the path, credentials and proxy agent for an Exchange Online (EWS) Target.

    Field Description
    Microsoft 365 Domain Enter your Microsoft 365 domain name.
    To scan the mailbox of a specific Microsoft 365 user account, see Edit Exchange Online (EWS) Target Path.
    New Credential Label Enter a descriptive label for the credential set.
    New Username Enter the service account user name. See Enable Impersonation in Microsoft 365 for more information.
    New Password Enter your service account password.
    Agent to act as proxy host Select a Proxy Agent host with direct Internet access.
  5. Click Test. If ER2 can connect to the Target, the button changes to a Commit button.
  6. Click Commit to add the Target.

Edit Exchange Online (EWS) Target Path

  1. Set Up Exchange Online (EWS) as a Target Location.
  2. In the Select Locations section, select your Exchange Online (EWS) Target location and click Edit.

  3. In the Edit Exchange Online (EWS) dialog box, enter a Path to scan. Use the following syntax:

    Path Syntax
    Specific user account <User Display Name>
  4. Click Test and then Commit to save the path to the Target location.