Configure Einstein Activity Capture with Microsoft Graph API and Exchange RBAC Using PowerShell

This article explains how to configure Exchange Role-Based Access Control (RBAC) with PowerShell so that Einstein Activity Capture (EAC) can use the Microsoft Graph API with mailbox-specific permissions.

Prerequisites and Useful Links

• Microsoft RBAC Documentation: Setting up RBAC Examples (and available roles for use in RBAC). Refer to this example and work with Microsoft to meet your own requirements and security.
• Salesforce Help: Graph API Integration for Einstein Activity Capture
• PowerShell on macOS: Installing PowerShell on macOS (uses Homebrew)

Using Exchange RBAC for Applications

Exchange RBAC allows you to dynamically add object scopes (permissions) to an application's access token when targeting specific mailboxes, providing fine-grained control that is superior to legacy EWS methods.

Note: RBAC can add permissions. It cannot dynamically remove scopes that were granted during initial application consent. Configuration currently requires PowerShell.

Step 1: Create a Service Principal

This step registers the application and its unique identifiers within Exchange Online. This must be done once per Azure tenant.

PowerShell Command:

New-ServicePrincipal -AppId xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -ObjectId dd147429-bf6d-4562-b12b-b05c580c1c82 -DisplayName "Einstein Activity Capture"

Note: When specifying the -AppId and -ObjectId parameters, retrieve these values from the Salesforce Enterprise Application created during the Einstein Activity Capture (EAC) consent process in Microsoft Entra ID. To locate the required values, navigate to Microsoft Entra ID > Enterprise applications and select the Enterprise Application generated when EAC consent was granted. Custom Azure/Entra applications are not supported, as EAC relies exclusively on a fixed, Salesforce-owned Enterprise Application for all Microsoft connection methods.

Step 2: Define a Management Scope

A Management Scope groups the target users (mailboxes) using a RecipientRestrictionFilter based on user attributes (for example, CustomAttribute1 or Department).

Example A: Grouping by Custom Attribute. The scope "EAC" targets mailboxes where CustomAttribute1 equals 'EAC_CEM'.

PowerShell Command:

New-ManagementScope -Name "EAC" -RecipientRestrictionFilter "CustomAttribute1 -eq 'EAC_CEM'"

Example B: Grouping by Department. The scope "RBAC Users Department" targets mailboxes where the Department equals 'RBAC Users'.

PowerShell Command:

New-ManagementScope -Name "RBAC Users Department" -RecipientRestrictionFilter "Department -eq 'RBAC Users'"

Step 3: Assign Management Roles (Add Scopes)

This step links the application (using the Object ID), the desired Graph API role (prefixed with Application), and the Management Scope defined in Step 2.

Full Access for the "EAC" Scope. These commands grant Read, Write, and Send permissions for Contacts, Calendars, and Mail to the Service Principal, limited only to users in the "EAC" scope.

PowerShell Commands:

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Mail.Send" -CustomResourceScope "EAC"

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Mail.Read" -CustomResourceScope "EAC"

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Calendars.ReadWrite" -CustomResourceScope "EAC"

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Calendars.Read" -CustomResourceScope "EAC"

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Contacts.ReadWrite" -CustomResourceScope "EAC"

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Contacts.Read" -CustomResourceScope "EAC"

Alternative: Limited Access for the "RBAC Users Department" Scope. This grants only Calendar and Contacts Read/Write access to users in the specified department, excluding Mail.

PowerShell Commands:

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Calendars.ReadWrite" -CustomResourceScope "RBAC Users Department"

New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Contacts.ReadWrite" -CustomResourceScope "RBAC Users Department"

Step 4: Test Authorization

Use the Test-ServicePrincipalAuthorization cmdlet to confirm which roles have been successfully applied to a specific user via the RBAC configuration.

PowerShell Command:

Test-ServicePrincipalAuthorization -Identity "Einstein Activity Capture" -Resource [user-email-address]

Important Note: Access changes via the Graph API may take a significant amount of time (for example, 30 minutes or more) to propagate and take effect, even if the test command returns positive results immediately.

Support Boundaries for Azure and Entra ID Configuration

Note: The example provided is for reference purposes only. Any configuration or setup required in Microsoft Azure or Entra ID, including application registration, permissions, or scope assignments, is managed by the domain's Microsoft administrator. Salesforce does not configure or support Azure-side components. Customers should follow Microsoft's official documentation when performing these steps.