Microsoft 365 Exchange Online Management | Dropzone AI Documentation

Configuration for Dropzone AI with Microsoft Defender for Office 365

This configuration is only required if you are using Dropzone AI to analyze Quarantined Emails in Microsoft Defender for Office 365.

To enable Office 365 Exchange Online Management, you must first install Dropzone Certificate Credentials.

Some Dropzone actions use x509 certificate based authentication, for example retrieving quarantined emails during phishing analysis. In this section we will set up the Dropzone certificate as trusted by Microsoft.

Each Dropzone tenant uses a unique Dropzone certificate for maximum security.

Navigate to your Dropzone AI tenant home page e.g. https://_mycompany_.dropzone.app
In the bottom left hand corner, click Settings > Integrations
Click "Available"
In the Search bar, search MS 365/Defender, then click "Configure"
Under Connection, click _mycompany_.dropzone.app.crt and download the file
Return to the Application Overview for your new application
https://entra.microsoft.com
- Applications > App Registration > All Applications > Dropzone AI
In the left side bar, click Certificates & Secrets
Navigate to Certificates, then click Upload Certificate
Select the certificate file you downloaded from the Dropzone UI earlier
For description, use "Dropzone AI"

You should now see the certificate in the UI, including a 'thumbprint' (a cryptographic hash of the certificate.)

Once you have installed your Dropzone credentials, you may assign the Office 365 Exchange Online Management permissions. To do so, do the following:

In the left sidebar, return to the API permissions page
Click Add a permission
Select APIs my organization uses
Type "Office 365 Exchange Online" in the search bar
Click Application permissions

Add the following permissions:

Permission	Purpose
`Exchange.ManageAsApp`	Read file details

Once done selecting all the permissions, click Add permissions
Click Grant admin consent for \[mycompany.net\]
Click Yes

Create and Authorize Service Account

Next we need to run PowerShell commands to grant permissions. You may use whatever PowerShell environment you prefer. The examples below were performed using Azure's interactive Cloud Shell. You may find some of the Microsoft Azure Documentation useful.

Open your PowerShell environment
For example go to https://portal.azure.com and click on the Cloud Shell icon
Connect to Entra ID and get information about the application we configured. The value for the -AppID parameter is the "Application (Client) ID" you recorded earlier

# Connect to "AzureAD"
Connect-AzureAD
# Run the following to get the object-id of our application, replacing
# application-id with the actual Application (Client) ID of our new app

Get-AzADServicePrincipal -AppID "<application-id>" | Select-Object DisplayName, AppId, Id | Format-List

# For example:
Get-AzADServicePrincipal -AppID "aaaaaaaa-1111-2222-3333-444444444444" | Select-Object DisplayName, AppId, Id | Format-List

DisplayName : Dropzone AI
AppId       : aaaaaaaa-1111-2222-3333-444444444444
Id          : 44726f70-7a6f-6e65-5761-734865726521

Note this Id field which we'll use in the next command, which we refer to as the object-spid (Service Principal ID)
Connect to Exchange Online and Create an Exchange Online Service Principal for our Application

# Connect to ExchangeOnline
Connect-ExchangeOnline
# Run the following to create the service principal, replacing
# application-id and object-spid from the earlier values

New-ServicePrincipal -AppId "<application-id>" -ObjectId "<object-spid>" -DisplayName "Dropzone AI"

# for example
New-ServicePrincipal -AppId "aaaaaaaa-1111-2222-3333-444444444444" -ObjectId "44726f70-7a6f-6e65-5761-734865726521" -DisplayName "Dropzone AI"

DisplayName    ObjectId                               AppId
-----------    --------                               ----- 
Dropzone AI    44726f70-7a6f-6e65-5761-734865726521   aaaaaaaa-1111-2222-3333-444444444444

Lastly, we assign Transport Hygiene Exchange Role to our Application

# Run the following to enable the Transport Hygiene role, replacing the
# application-id with the actual Application (Client) ID of our new app

New-ManagementRoleAssignment -App "application-id" -Role "Transport Hygiene"

# for example
New-ManagementRoleAssignment -App "aaaaaaaa-1111-2222-3333-444444444444" -Role "Transport Hygiene"

Name                           Role                RoleAssigneeName       RoleAssigneeType   AssignmentMethod   EffectiveUserName
----                           ----                ----------------       ----------------   ----------------   -----------------
Transport Hygiene-44726f70...  Transport Hygiene   ba0efd83-6465-48a...   ServicePrincipal   Direct

Locate Organization ID

Sign into Entra home as an administrator
In the left navigation, select Manage > Custom domain names
In the domain list you'll find one that ends in .onmicrosoft.com. Record this domain for use later in the Dropzone UI where it is called "Organization ID"