Skip to main content

Cyware Threat Intelligence eXchange

  • Cyware Threat Intelligence eXchange
  • How To Articles
  • Configure Threat Mailbox in Intel Exchange using OAuth authentication for IMAP

Configure Threat Mailbox in Intel Exchange using OAuth authentication for IMAP

Notice

This feature is available in Intel Exchange v3.7.5.1 onwards.

You can configure your Microsoft mailbox account as a Threat Mailbox in Intel Exchange to directly receive emails within the application.

For authenticating an IMAP-based mailbox, Intel Exchange supports OAuth 2.0 authentication through Microsoft Entra ID.

To configure the Intel Exchange IMAP application for OAuth, follow these steps:

  1. Register your Application with Microsoft Entra ID

  2. Configure Application Permissions

  3. Generate Client Secret

  4. Retrieve Application’s Object ID

  5. Configure Service Principal Using PowerShell

  6. Configure Threat Mailbox in Intel Exchange

Register your Application with Microsoft Entra ID

To use OAuth 2.0 for IMAP-based mailboxes, you must first register your application with Microsoft Entra ID. This registration generates the credentials required to authenticate your mailbox in Intel Exchange.

Steps:

To register your application, follow these steps:

  1. Sign in to the Azure Portal.

  2. Search and select App registrations under Azure Active Directory.

  3. To register a new app, click New Registration.

  4. In Name, enter a name for the app.

    Note

    You can leave all other settings at their default values.

    register-app__1_.png

  5. Click Register to create the application. After registration, go to the Overview section to view and copy the following: 

    • Application (client) ID

    • Directory (tenant) ID 

    overview-client-details__1_.png

Configure Application Permissions

After registering your application, assign the required API permissions to allow Intel Exchange to access mailbox data using IMAP.

Steps 

To configure application permissions, follow these steps:

  1. Go to Manage > API permissions in your registered app.

  2. Click Add a permission, select APIs my organization uses, and then search for and select Office 365 Exchange Online. 

    Add_API_permissions__1_.png

  3. Select Application permissions. In Select permissions, expand the IMAP section and select IMAP.AccessAsApp. 

    request_api_permissions.png

  4. Click Add permissions.

  5. Click Grant admin consent for <Tenant> and select Yes to apply these permissions. After the permissions are granted, the status is updated to Granted. 

    grant-consent__1_.png

Generate Client Secret

Generate a client secret for your registered application. Intel Exchange uses this secret as the authentication token when connecting to the mailbox using IMAP.

Steps 

To generate a client secret, follow these steps:

  1. In the Azure portal, go to your registered application.

  2. Go to Manage > Certificates & secrets. Click New client secret and enter the following information:

    1. Enter a description and select an expiration period.

      Note

      Client secret lifetime is limited to a maximum of 24 months. Microsoft recommends setting it to less than 12 months. For more information, see Add and manage application credentials in Microsoft Entra ID.

    2. Click Add. Copy and store the Value of the client secret securely. You will not be able to view it again after you leave the page. 

      Client-secret__2_.png

Retrieve Application’s Object ID

You need the application's Object ID to configure the service principal permissions using PowerShell.

Steps:

To retrieve the Object ID, follow these steps:

  1. In the Azure portal, go to the Microsoft Entra ID service.

  2. Under Manage, select Enterprise applications.

  3. Search and select your registered application.

  4. On the application's Overview page, copy the following values:

    • Application (client ID)

    • Object ID

Configure Service Principal Using PowerShell

Use PowerShell to grant the registered application access to the mailbox by assigning the required permissions.

Before you Start 

Ensure you are logged in as a user with either the Global Administrator or Exchange Administrator role. This is required to register a service principal and assign mailbox permissions.

Steps 

To configure the service principal, follow these steps:

  1. Open Azure Cloud Shell or launch PowerShell with administrator privileges.

  2. Run the following commands individually:

    Install-Module ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline
New-ServicePrincipal -AppId <AppId> -ObjectId <ObjectId>
Add-MailboxPermission -Identity <user@domain.com> -User <ObjectId> -AccessRights FullAccess

    Replace the placeholders <AppId>, <ObjectId>, and <user@domain.com> with the actual values from the previous steps.

  3. After executing the commands, verify that the permissions have been successfully applied to the service principal.

    Note

     If mailbox access fails during integration, recheck the placeholder values used in the commands and ensure that the IMAP.AccessAsApp permission was granted successfully.

Configure Threat Mailbox in Intel Exchange

Configure your mailbox in Intel Exchange using IMAP and OAuth 2.0 authentication.

Before you Start 

  • Ensure your user group has the Create Threat Mailbox and Update Threat Mailbox permissions in Intel Exchange.

  • Ensure that you generated the Tenant ID, Client ID, Client Secret, Object ID, and Mailbox Email Address values.

  • Ensure the provided mailbox email has the following:

    • IMAP access is enabled for the mailbox

    • Is associated with a valid Microsoft Exchange account

Steps 

To configure the Threat Mailbox in Intel Exchange using IMAP OAuth, follow these steps:

  1. Sign in to the Intel Exchange application.

  2. From Administration, go to Integration Management.

  3. Under Feed Sources, select Email, and click Add Email Source.

  4. Provide the following details:

    • Name: Enter a name for the Threat Mailbox

    • Account Type: Select IMAP

    • Authentication Type: Select MS OAuth 2.0

  5. Enter the following values:

    1. Email/Username

    2. Secret Key

    3. App ID

    4. Tenant ID

  6. Click Save and Continue. 

    Screenshot_2025-08-06_at_2_44_43_PM.png

  7. Select the mailbox folders from which Intel Exchange should sync emails, and complete the setup. 

    Screenshot_2025-08-06_at_2_46_47_PM.png

  8. After configuration, go to the Threat Mailbox in Intel Exchange to verify that emails are being syned successfully. For more information on configuring a Threat Mailbox in Intel Exchange, see Email Sources.