Cloudflare Docs
Area 1 Email Security
Area 1 Email Security
Edit this page on GitHub
Set theme to dark (⇧+D)

Office 365 Graph API set up with Area 1

For customers using Microsoft Office 365, setting up Area 1 via Microsoft Graph API is quick and easy. The following email flow shows how this works:

Email flow when setting up Area 1 with the Microsoft Graph API

​​ User roles

Area 1 uses two roles for retraction and directory integration purposes:

  • Privileged authentication administrator: Users with this role can view the current authentication method information and set or reset non-password credentials for all users, including global administrators. Privileged authentication administrators can force users to re-register against existing non-password credentials (like MFA or FIDO) and revoke the remember MFA on the device message prompting for MFA on the next login of all users.
  • Privileged role administrator: Users with this role can manage role assignments in Azure Active Directory, as well as within Privileged Identity Management. In addition, this role allows management of all aspects of Privileged Identity Management.

Directory Integration requires the use of both roles mentioned above. Email retraction only requires the Privileged role administrator. Any Azure administrator with a membership in the required role can perform these authorizations. The authorization process grants the Area 1 dashboard access to the Azure environment. This access is performed with the least applicable privileges required to function, as shown in the table below.

The Enterprise Applications that Area 1 registers are not tied to any administrator account. Inside of the Azure Active Directory admin center you can review the permissions granted to each application in the Enterprise Application section. Refer to Application management documentation for more information.

​​ Set up Microsoft Graph API

  1. Log in to the Area 1 dashboard.

  2. Go to Settings (the gear icon).

  3. In Email Configuration > Domains & Routing > Domains, select New Domain.

  4. In Domain, enter the domain you want to onboard.

  5. In Authorize Mail Access, select Authorize Access.

    Select Authorize access to give the correct permissions do Area 1
  6. In the new tab that opens, choose an Office 365 account you want to authorize, or enter your credentials.

  7. Read the permissions, and select Accept to continue. You will be directed back to the Area 1 dashboard.

  8. In Directory Scanning, select Authorize Access.

  9. In the new tab that opens, choose an Office 365 account you want to authorize, or enter your credentials.

  10. Read the permissions, and select Accept to continue. You will be directed back to the Area 1 dashboard.

  11. In Protection Scope, choose if Area 1 should scan only the inbox or all folders. Scanning all folders is useful for situations where the email is automatically routed to other folders that users still have access to:

    1. Protect Inbox only: Area 1 will only scan the user’s inbox.
    2. Protect all folders: Area 1 will scan all non-hidden email folders.
  12. Now that both types of authorizations have been complete, select Publish Domain.

Your authorized domain will show up in Email Configuration > Domains & Routing > Domains, with messages about the progress of directory syncing between Office 365 and Area 1.

Now that both authorizations are complete, select Publish domain

​​ Azure applications

​​ Directory Integration

The following table shows API permissions required for Directory Integration as it appears in Azure Enterprise applications.

API NameClaim valuePermissionTypeGranted throughGranted by
Microsoft
Graph
User.ReadSign in and read user profileDelegatedAdmin consentAn administrator
Microsoft
Graph
Group.Read.AllRead all groupsApplicationAdmin consentAn administrator
Microsoft
Graph
Directory.Read.AllRead directory dataApplicationAdmin consentAn administrator
Microsoft
Graph
User.Read.AllRead all users’ full profilesApplicationAdmin consentAn administrator
Microsoft
Graph
GroupMember.Read.AllRead all group membershipsApplicationAdmin consentAn administrator

​​ Retraction

The following table shows retractions as they appear in Azure Enterprise applications.

API NameClaim valuePermissionTypeGranted throughGranted by
Microsoft
Graph
Mail.ReadWriteRead and write mail in all mailboxesApplicationAdmin consentAn administrator
Microsoft
Graph
Group.Read.AllRead all groupsApplicationAdmin consentAn administrator
Microsoft
Graph
User.Read.AllRead all users’ full profilesApplicationAdmin consentAn administrator
Microsoft
Graph
Domain.Read.AllRead domainsApplicationAdmin consentAn administrator
Microsoft
Graph
GroupMember.Read.AllRead all group membershipsApplicationAdmin consentAn administrator
Microsoft
Graph
Organization.Read.AllRead organization informationApplicationAdmin consentAn administrator