How to Configure Microsoft Graph API Permissions for Barracuda Message Archiver 5.5.4
This article refers to Barracuda Message Archiver firmware release version 5.5.4 or higher, and Microsoft Exchange Online. For more information on how to update to the latest firmware, see Updating Your Firmware and Definitions.
Starting with firmware version 5.5.4, Barracuda Message Archiver uses the Microsoft Graph API to import data from Exchange Online. When setting up an Exchange Online source, you can use an existing Microsoft Entra app registration or create a new one. In either case, the app must have the required Microsoft Graph API Application permissions.
Option 1. Use an existing app registration – Keep the existing app registration currently used by Barracuda Message Archiver, including any existing EWS permissions such as
full_access_as_app, and add the required Microsoft Graph API permissions to it.Option 2. Create a new app registration – Create a new app registration in Microsoft Entra, and then add the required Microsoft Graph API permissions listed below as Application permissions.
Note: If you are running firmware version 5.4.3 through 5.5.3, see How to Create an Application ID and Application Secret for Barracuda Message Archiver in Microsoft 365 for EWS-based configuration.
Use this option if you already have an app registration for Barracuda Message Archiver with Exchange Web Services (EWS) permissions.
Log in to the Microsoft 365 Admin center as a global admin: https://admin.microsoft.com/.
In the left-hand menu, select All admin centers > Microsoft Entra.
Under Applications > App registrations, select All applications, and then select the app registration currently used for Barracuda Message Archiver.
In the app registration, select API permissions.
Add the required Microsoft Graph API permissions listed in the Required Graph API permissions table below.
Note: Do not remove the existing EWS permissions until the Microsoft Graph importer has been tested successfully. If the app registration is also used by an older firmware version or another service, keep those permissions unless you have confirmed that they are no longer required.
Option 2. Create a New App Registration
Follow these steps only if you are creating a new app registration. If you are reusing an existing app, follow the instructions in Option 1. Use an Existing App Registration instead.
Log in to the Microsoft 365 Admin center as a global admin: https://admin.microsoft.com/.
In the left-hand menu, select All admin centers > Microsoft Entra.
Under Applications > App registrations, select New registration.
Enter a name for the app. For example, "ArchiverApp".
Under Supported Account Types, select Single Tenant only.
Select Register.
Add the Required Microsoft Graph API Permissions
Barracuda Message Archiver requires Microsoft Graph Application permissions to access your Microsoft 365 data during imports.
In the app’s left-hand menu, select API permissions.
Select + Add a permission.
Select Microsoft Graph.
Select Application permissions.
In the search box, find and select each permission listed in the table below. You can select multiple permissions before confirming.
Select Add permissions.
Select Grant admin consent for [your organization]. In the confirmation dialog, select Yes.
Permission | Purpose | When Required |
|---|---|---|
| Enumerate mailboxes across the tenant | Always |
| Read mail folders, messages, MIME content, and sticky notes | Always |
| Read calendar events (PIM sync) | Always |
| Read contacts (PIM sync) | Always |
| Read Microsoft To Do tasks (PIM sync) | Always |
| Resolve distribution list membership | Only if selecting mailboxes through a distribution list |
| Sign in and read the profile of the signed-in user (Delegated) | Default permission added automatically by Microsoft Entra; not required for unattended background mailbox import (can be removed) |
| Read directory data (users, groups, tenant metadata, and domain information) (Application) | Only required if querying broader tenant directory objects, domain discovery, or synchronizing full directory metadata |
Generate Application Secret
If you are using an existing app registration, you can use its current client secret if it is still valid. If you are creating a new app registration, or if the existing secret is expired or expiring, create a new client secret by following the steps below.
In the left-hand menu, select Certificates & secrets, and then select New client secret.
Add a description and an expiration date. Barracuda recommends using 730 days (24 months). Then select Add.
Once your client secret is created, copy and save the Value as it may not be displayed again. Note that this is not the Secret ID.
In the left-hand menu, select Overview and copy the Application (client) ID.
The Value and Application (client) ID you copied can now be used to authorize Barracuda Message Archiver.
Post-Configuration Cleanup
After the Microsoft Graph importer has been tested successfully, you can remove the legacy EWS permissions, including full_access_as_app, only if they are no longer required by Barracuda Message Archiver, an older firmware version, or another service. If you created a new app registration for Option 2, decommission the previous EWS app registration only after confirming that no other service uses it.