Orgwide Integration via Microsoft Graph

1) Scope of Integration

Use-case: Organization-wide connection to Microsoft 365 for calendar and email sync within Rox.

Supported data access:

Permission model:
Application-level permissions (granted once by a Microsoft 365 tenant admin).
No per-user consent required after setup.
No delegated scopes are used for this integration.

Important Note

Since Microsoft does not allow admins to selectively choose permissions which they can consent to in the application permissions model, admins will have to consent to all permissions in the Authorization page to start with. As soon as the integration is set up in Rox, admins should go to the Entra portal and revoke the excess permissions.

For enhanced security measures, Rox suggests admins to first create mail-enabled security groups to control and restrict access. More details on this in step 8.

2) Components & Hosting Locations

Rox does not host or proxy any Microsoft infrastructure. Your Microsoft Entra tenant remains the authority for all authentication and access control.

3) Microsoft Entra (Azure AD) Application Details

4) Integration Flow

1. A Microsoft 365 Global Admin or Privileged Role Administrator sets up a mail-enabled security group and ensures that Rox's tenant can only access the data of those users which will be using Rox.
2. Once the security group is set up, the admin connects the organization’s Microsoft tenant to Rox using Org-wide Integration.
3. The admin is redirected to Microsoft’s standard admin consent screen showing requested permissions.
4. Upon consent, Microsoft issues an application token to Rox for organization-level access.
5. Rox uses these application permissions to:
   1. Sync calendar events bi-directionally between Outlook and Rox (for authorized users only)
   2. Read and sync emails (for authorized users only) and optionally write emails
   3. Maintain user directory mappings to match mailboxes and permissions
6. No per-user authentication is required. Rox respects organizational policies for mail and calendar data access.

5) Data Handling & Privacy

6) Security Controls

7) Customer Action Checklist (IT / Admin)

1. Set-up a mail-enabled security group using the instructions in step 8.
2. Go to Rox UI and follow the instructions in step 9 to create the integration
3. Review and approve the Rox 365 Integration request through the Microsoft auth page.
4. Since Microsoft does not allow admins to selectively choose the permissions for consent, the admin must grant tenant-wide admin consent for the following scopes during the initial integration flow. They should go to Entra portal and revoke the extra permissions after this step:
   1. Mail.BasicRead.All
   2. Mail.Read
   3. Mail.ReadWrite
   4. Mail.Send
   5. Calendars.Read
   6. Calendars.ReadWrite
   7. Directory.Read.All
5. Verify that Rox appears under Enterprise Applications → Rox 365 Integration in your Entra portal.
6. Revoke the extra permissions that you do not want Rox to have.
7. Confirm that Conditional Access and other Microsoft security policies (e.g., MFA, IP restrictions) are applied as per your standards.
8. Optionally, configure user-level restrictions for email/calendar syncing in the Rox Admin Console.
   
   

8) Steps for setting up a mail-enabled security group (for IT Admins)

1. Connect to exchange online

Connect-ExchangeOnline -UserPrincipalName admin@domain.com

1. Create the mail-enabled security group

New-DistributionGroup -Name "LimitedAppAccessGroup" -Type Security

3. Add members (the users whose data the app can access)

Add-DistributionGroupMember -Identity "LimitedAppAccessGroup" -Member 
user1@domain.com
 Add-DistributionGroupMember -Identity "LimitedAppAccessGroup" -Member 
user2@domain.com

You can also use the group domain here to directly add all the members of a group.

4. Link Rox’s Client ID to that group

New-ApplicationAccessPolicy `
    -AppId "929e5802-e473-45d3-b032-44977407583c" `
    -PolicyScopeGroupId "LimitedAppAccessGroup@domain.com" `
    -AccessRight RestrictAccess `
    -Description "Limit Graph Mail and Calendar access to specific users"

5. Verify

Test-ApplicationAccessPolicy `
    -Identity user1@domain.com `
    -AppId "<YOUR-APP-CLIENT-ID>"

Result should be granted for an added member and denied for a non-member

9) Connection Steps in Rox (for IT Admins)

1. Go to https://run.rox.com/settings > Integrations

1. Click on the Connect button for Microsoft Enterprise
2. Configure the individual access for Calendar

1. Configure the individual access for Email. Add any restricted domains as well.

1. Add your tenant id from Microsoft Entra portal and the email IDs of the users you want to restrict the email access for

1. Click on Connect which will take you to the Microsoft Authorization page. Click on Accept

1. You will be redirected to the Rox application where you can see that the Microsoft Enterprise integration will be connected. The users will no longer be able to connect any of Google/Microsoft email and calendar separately.

1. Revoke any excess permissions in Entra

10) Summary