Setting up a shared mailbox with service principal for Cydarm email poller

Overview

Use this setup when you have a shared inbox receiving security messages and want to
automatically create Cydarm cases from those emails.

Prerequisites

• Microsoft 365 admin access
• Entra ID admin permissions
• Cydarm system administrator access or at least "integration manager" attribute

Step 1: Create the shared mailbox

1. Navigate to the Microsoft 365 admin center
2. Go to Teams & groups > Shared mailboxes
3. Click Add a shared mailbox
4. Enter a name (e.g., "Alert Test 2")
5. Add any description if needed
6. Click Add

Note: The shared mailbox will appear as a user in your active users list, but it will have:

• Sign-in blocked
• No licenses assigned
• No group memberships
• Disabled account status

Step 2: Create a Service Principal

1. Open the Microsoft Azure portal
2. Navigate to Microsoft Entra ID > App registrations
3. Click New registration
4. Enter a suitable name
5. Click Register

Step 3: Configure API Permissions

1. In your new app registration, go to API permissions
2. Click Add a permission
3. Select Microsoft Graph
4. Choose Application permissions (not delegated)
5. Add the following permissions:
   1. MailboxFolder.Read.All - to read all mailbox folders
   2. Mail.ReadWrite - to read emails and mark them as read after processing
6. Click Grant admin consent for your organization

Important: Admin consent is required for these permissions to take effect.

Step 4: Create Client Secret

1. In your app registration, go to Certificates & secrets
2. Click New client secret
3. Enter a description
4. Select expiration period (default: 180 days)
5. Click Add
6. Copy the secret value immediately - you won't be able to see it again

Step 5: Gather Required Information

Collect the following details for the Cydarm configuration:

• Tenant ID - from the app registration Overview page
• Client ID - from the app registration Overview page
• Client Secret - the value you just created
• Mailbox Object ID - from the shared mailbox user's profile in Entra ID

Step 6: Configure Cydarm Email Poller

Note: You must have the "integration manager" attribute on your Cydarm user profile to perform
these steps.

1. In Cydarm, navigate to Connectors
2. Click Create connector
3. Select Email poller account
4. Configure the following fields:
   1. Name: Descriptive name (e.g., "Alert Test 2 Poller")
   2. Type: MS Graph API
   3. Azure Tenant ID: Paste the tenant ID
   4. Username: Paste the client ID
   5. Password: Paste the client secret
   6. Mailbox: Enter {mailbox-object-id}:Inbox
5. Set Organization to your organization, if there is more than one organization
6. Set a severity for cases created from email (not mandatory)
7. Configure an ACL if required - usually “YourOrg case data defaults”
8. Activate the connector

Step 7: Test the Setup

1. Send a test email to the shared mailbox address
2. Check your Cydarm Case List for the new case
3. Verify the case contains the correct email content and metadata

Troubleshooting Tips

• Ensure you have "integration manager" permissions in Cydarm to create connectors
• Ensure admin consent has been granted for API permissions
• Verify the mailbox Object ID is correct (not the email address)
• Check that the client secret hasn't expired
• Confirm the shared mailbox is receiving emails properly
• Review Cydarm connector logs for any error messages

Security Notes

• The service principal operates independently and doesn't require user sign-in
• Client secrets should be rotated regularly before expiration
• Monitor the connector's access and activities through Entra ID logs