Turn on mailbox actions for Microsoft Entra ID

With 1Password SaaS Manager, you can run mailbox actions in workflows, such as setting an out-of-office message or forwarding a person’s email when they leave your company.

Mailbox actions run through an app that you register in Microsoft Entra ID. You connect the app to SaaS Manager alongside your Authorization Code Flow connection, so you don’t need to switch to client credentials. If you want to connect with client credentials alone, learn how to connect Microsoft Entra ID with client credentials instead.

Before you begin

Before you begin, you’ll need:

• A Microsoft Entra ID role that can register apps, such as Application Developer.
• The Privileged Role Administrator role to grant administrator consent and assign an Entra ID role to the app. If you don’t have this role, ask someone who does to grant consent in step 2 and assign the role in step 3.
• The Directory Writers role on the account you connect with, so you can turn on deprovisioning.

Step 1: Register the app

Follow Microsoft’s steps to register an application in Entra ID. Fill out the following fields:

• Name: Enter a name, such as “SaaS Manager mailbox actions”.
• Supported account types: Select the single tenant option.
• Redirect URI: Leave this field blank.

Step 2: Add the Exchange permission

The app only needs the Exchange permission. You don’t need to add Microsoft Graph permissions. To add the permission and grant administrator consent:

1. On the API permissions page, select Add a permission.
2. Select the APIs my organization uses tab, then select Office 365 Exchange Online.
3. Select Application permissions, expand the Exchange section, and select Exchange.ManageAsApp.
4. Select Add permissions.
5. On the API permissions page, select Grant admin consent, then select Yes.

Learn more about granting tenant-wide admin consent.

Step 3: Assign an Exchange role to the app

Mailbox actions need an Exchange role on the app, not on a user account. Follow Microsoft’s steps to assign Microsoft Entra roles. Fill out the following fields:

• Role: Select Exchange Recipient Administrator.
• Select member(s): Select the enterprise application Entra ID created for your app registration. It has the same name, and its application (client) ID matches the one you’ll enter in SaaS Manager in step 5.
• Assignment type: If your tenant uses Privileged Identity Management, select Active and enter a justification.

The account you connect with doesn’t need this role. Mailbox actions run as the app, not through an account.

Step 4: Create a client secret

Follow Microsoft’s steps to add a client secret. Fill out the following fields:

• Description: Enter a description, such as “SaaS Manager”.
• Expires: Choose an expiration and make a note of the expiration date. To keep the integration running, you’ll need to create a new secret before this one expires.

Step 5: Connect SaaS Manager

Sign in to SaaS Manager. If you’ve already connected Microsoft Entra ID, select the ellipsis beside it, then select Disconnect so you can turn on deprovisioning. Then follow these steps:

1. Select Integrations in the sidebar.
2. Search for and select Microsoft Entra ID.
3. Select Connect (or Reconnect).
4. Under Authentication method, select Auth Code.
5. Select Deprovisioning, and any other features you want to use.
6. Fill out the following fields:
   • Application (client) ID: Paste the Application (client) ID from the app’s Overview tab in Entra ID.
   • Client Secret: Paste the client secret Value you copied in step 4.
7. Select Connect, then follow the steps to connect with Authorization Code Flow.

Next steps

After you’ve turned on mailbox actions, add mailbox actions to your offboarding workflow. Learn how to offboard accounts from Microsoft 365.

Learn more

• Connect Microsoft Entra ID with client credentials
• Microsoft Entra ID / Microsoft 365