Microsoft Azure Configuration Guide for Connecting to Selma

Overview

This guide will help IT administrators configure your organization's Microsoft Azure environment to allow your users to connect their email accounts to Selma. Selma has already registered the application that your users will connect to, but your Azure tenant may need specific configurations to allow this connection.

Step 1: Enable User Consent for the Selma Application

For your users to be able to connect their Microsoft accounts to Selma, you need to ensure that user consent is enabled in your Azure Active Directory:

1. Sign in to the Azure Portal as a Global Administrator
2. Navigate to Azure Active Directory
3. Select Enterprise applications from the menu
4. Click on User settings
5. Under Enterprise applications, review the Users can consent to apps accessing company data on their behalf setting
   • If set to Yes, individual users can provide consent to Selma
   • If set to No, you will need to provide admin consent (see Step 2)

Step 2: Configure Mail Flow Permissions

Ensure that your Microsoft Exchange Online settings allow Selma to connect:

1. Sign in to the Microsoft 365 admin center
2. Navigate to Settings > Org Settings
3. Select the Security & Privacy tab
4. Check that there are no mail flow rules that would block authentication to third-party applications

Step 3: Check Microsoft Defender for Cloud Apps Policies (if applicable)

If your organization uses Microsoft Defender for Cloud Apps:

1. Sign in to the Microsoft 365 security center
2. Navigate to Cloud Apps > Policies
3. Review your policies to ensure they don't block users from connecting to Selma
4. Consider adding Selma to your list of approved applications

Step 4: Set Up Modern Authentication (if not already enabled)

Modern authentication should be enabled for your Exchange Online tenant:

1. Sign in to Exchange admin center
2. Navigate to Settings > Organization
3. Ensure that Modern authentication is enabled

Step 5: Check Mail Access Policies

Ensure that your organization's Conditional Access policies don't inadvertently block Selma:

1. In the Azure Portal, navigate to Azure Active Directory
2. Select Security > Conditional Access
3. Review your policies to ensure they don't restrict access to mail APIs for third-party applications
4. If necessary, create exceptions for the Selma application (using the client ID provided by Selma support)

User Connection Process

Once you've completed the necessary configurations, your users will be able to connect to Selma by:

1. Logging into Selma
2. Selecting the Microsoft (Outlook/Office 365) option for connecting their email
3. Authenticating with their Microsoft credentials
4. If admin consent has not been pre-approved, they will need to approve the permissions requested by Selma
5. After successful authorization, their email account will be connected to Selma

Required Permissions

For your information, Selma requests the following permissions from Microsoft:

• Read user mail
• Send mail as the user
• Read user profile
• Maintain access through refresh tokens

These permissions are necessary for Selma to provide its service, which includes reading emails and sending emails on behalf of your users.

Troubleshooting Connection Issues

If your users encounter problems connecting their Microsoft accounts:

Authorization Failures

• Ensure that consent settings are properly configured in your Azure AD tenant
• Check for restrictive Conditional Access policies

Connection Timeouts

• Verify that there are no network restrictions blocking connections to Microsoft authentication endpoints

"Admin Approval Required" Messages

• This usually indicates that admin consent has not been granted and user consent is disabled
• Follow Step 2 to provide admin consent for your organization

Other Issues

If users continue to experience connection problems, please contact Selma support with:

• The specific error message the user is receiving
• Your Azure AD tenant ID
• Confirmation of which steps in this guide you have completed

Support

If you need assistance with these configurations, please contact Selma support or your Microsoft administrator.

‍

‍