Before either the Microsoft 365 Agent or the M365 Sent Items Update Agent can connect to your tenant, you need to register an application in Azure. This is what gives ExSign the Client ID and Tenant ID it authenticates with (see How ExSign for M365 Works). Do this once; both agents will use the same registration, with one extra permission needed if you're using the Sent Items Update Agent. 

Register the Application 

1. Go to the Azure Portal and sign in.  
2. Open Microsoft Entra ID.  
3. Go to App registrations >> New registration.  
4. Under Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant, Multitenant).  
5. Click Register. 

Save Your Client ID and Tenant ID 

Once registered, the app's Overview page shows the Application (client) ID and Directory (tenant) ID. Copy both down now, you'll need them when connecting the Microsoft 365 Agent later. 

Create a Client Secret 

1. Under Client credentials, click Add a certificate or secret.  
2. Go to Certificates & secrets, then New client secret.  
3. Give it a description and an expiry, then click Add. 

Grant API Permissions 

1. Go to API permissions >> Add a permission >> Microsoft Graph >> Application permissions. 
2. Search for and add each of these three:  
   • User.Read.All
   • Domain.Read.All
   • Group.Read.All
3. If you're also setting up the M365 Sent Items Update Agent, add one more: go to APIs my organization uses, find the relevant Exchange/Office API, select Application Permissions, and add full_access_as_app.  
4. Click Grant admin consent for [your organization], then confirm with Yes. 

Your finished permission set should be: