Microsoft 365 Message Trace Setup

This procedure enables the Message Trace API for an Microsoft 365 installation, which helps Expel investigate phishing submissions. This procedure varies depending on which option you selected while connecting your Microsoft 365 installation to Workbench:

• If you chose to enable the Expel O365 integration during your onboarding, follow the steps in Option 1.
• If you chose to create a custom Entra ID app during your onboarding, follow the steps in Option 2.

If you need additional help, contact Support.

Option 1 (Expel O365 Integrations)

New Installation

1. In the Microsoft Entra admin center, search for and select Microsoft Entra roles and administrators.
2. On the All roles page, search for and select the Security reader role.
3. Select Add assignments.

1. Search for the Expel O365 Integration enterprise app and select it.
2. Select Add.
3. Perform steps 3-6 again, but selecting the Global reader role.

Existing Installation

1. In the Microsoft Entra admin center, search for and select Expel O365 Integration > API Permissions, and then select Grant admin consent.
2. Consent to the new API permissions.
3. Navigate to Microsoft Entra roles and administrators.
4. On the All roles page, search for and select the Security reader role.
5. Select Add assignments.

   
6. Search for the Expel O365 Integration enterprise app and select it.
7. Select Add.
8. Perform steps 3-6 again, but selecting the Global reader role.

Option 2 (Custom Entra ID Apps)

These steps apply to both new and existing installations.

1. Follow all previous API permission steps for the custom app in Microsoft 365 Setup for Workbench.
2. Navigate to the custom app and select API Permissions.
3. On the APIs my organization uses tab, select Add a permission.
4. Search for and select Microsoft 365 Exchange Online.

1. Select Application permissions, and then, in the Select permissions search field, search for ReportingWebService.

1. Select the ReportingWebService.Read.All permission, and then select Add permissions.
2. In the confirmation, select Grant admin consent for Expel and then select Yes.
3. Confirm that consent is granted for the added permission in the Status column.
4. Navigate to Microsoft Entra roles and administrators.
5. Search for and select the following roles:

   • Global reader
   • Security reader
6. Select Add assignments.

1. Search for the custom app and select it.
2. Select Add.