OAuth2 authentication to Office 365 mailbox

PSFA-Sysad

Hello-
I am attempting to set up OAuth2 authentication for use with several Office 365 mailboxes and need a bit of guidance.

Can I use a single user with which to authenticate any email account? I am thinking this is the case and operates by unchecking the Strict Matching option in the OAuth2 setup page. I don't want to have to configure OAuth2 for every single email account.
When attempting to do what I indicated in step 1, I am receiving the following:

Application with identifier 'http://osticket.blahblah.org/api/auth/oauth2' was not found in the directory ''..

Know I am missing some obvious stuff here. Guidance would be appreciated.

Thanks

KevinTheJedi

PSFA-Sysad

Of course, you just need to ensure the user has full Send As and Read and Manage access to all needed accounts. Then yes you need to disable Strict Matching and login as the user that has said access instead of the mailbox you are configuring.
You did not follow the documentation and create an App Registration or if you did you didn’t add a Redirect URI. If you did add one then you didn’t add the right one. I would suggest reviewing the documentation and retesting.

Cheers.

PSFA-Sysad

Thanks Kevin. I did not see the information about Send As and Read and Manage in the documentation, but makes perfect sense. I am now trying to set up my single user for OAuth and, despite having done it twice following this: https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html, I am receiving a Resource Owner and Email mismatch error.

In this case, the email is sysad@blah.com and I configured the application / logged in as sysad@blah.com. Straightforward...

KevinTheJedi

PSFA-Sysad

If you get that error then you didn't disable the Strict Matching check. If you did then simply resubmit the popup and see if it saves the second time.

Cheers.

PSFA-Sysad

I left the strict matching checked at first because the in the email matched the user in O365 / Entra. However, I have zero problem leaving it unchecked. I'm starting to get my head around this...thanks for the help Kevin!

Now I'm trying to add an additional email account. I am selecting Microsoft OAuth 2 under the Remote Mailbox tab. Under Config, I typed in the new email address and unchecked strict matching. However, it looks like idp config has defaulted back to ground zero?? Do I need to re-fill in the information for the new email account?

Thinking the answer is yes. Filled in and seem to be heading in the right direction. Last error is Resource Owner and Email mismatch despite the Strict Matching box being unchecked.

KevinTheJedi

PSFA-Sysad

You’ll have to reconfigure the OAuth2 information for each email, yes. If you get the error with it unchecked then as I mentioned above you can resubmit the popup and it should work the second time. There is some sort of issue with that checkbox on the first save.

Cheers.