topic Re: O365 mail Graph API Integration - Best Practices in Cortex XSOAR Discussions

O365 mail Graph API Integration - Best Practices

Moh.Yasser — Mon, 29 Apr 2024 21:19:04 GMT

Hey all,

I was exploring O365 graph API and wondering what are some of the best practices for this integration.

One thing we came up was to IP restriction (Palo alto IP) in Microsoft side.

Are there any other condition access policies that can be added to make sure we follow best practices, other than securing the Palo alto tenant and Microsoft tenant as a whole?

Re: O365 mail Graph API Integration - Best Practices

SPatil15 — Tue, 30 Apr 2024 00:43:42 GMT

Hey,
You need to make sure below required permissions are enabled to run the O365 Outlook Mail (Using Graph API) integration commands successfully;

Mail.ReadWrite - Application
Mail.Send - Application
MailboxSettings.ReadWrite - Application

Re: O365 mail Graph API Integration - Best Practices

Moh.Yasser — Tue, 30 Apr 2024 15:39:44 GMT

Yes. It depends on the usecase that we need to enable these permissions.

If its only for searching and deleting emails and sending emails, we wouldnt need access to Mailbox settings right?

Im looking to explore the best practices for the integration overall as this gives high privileges.

Re: O365 mail Graph API Integration - Best Practices

SPatil15 — Wed, 01 May 2024 10:02:08 GMT

You can start with minimal permissions and see if the use case you trying works. As per our documentation, the above three permissions are required for all the commands to run. Also as stated in this doc use the client credentials flow instead of device code flow as a best practice.