Configuring Einstein Activity Capture with Microsoft Graph API and RBAC.

Prerequisites and Useful Links

• Microsoft RBAC Documentation: Setting up RBAC Examples (and available roles for use in RBAC), please refer to this example and work with Microsoft to meet your own requirements and security.
• Salesforce Help: Graph API Integration for Einstein Activity Capture
• PowerShell on macOS: Installing PowerShell on macOS (uses homebrew)

Using Exchange RBAC for Applications

Exchange RBAC allows you to dynamically add object scopes (permissions) to an application's access token when targeting specific mailboxes, providing fine-grained control that is superior to legacy EWS methods.

Note: RBAC can add permissions; it cannot dynamically remove scopes that were granted during initial application consent. Configuration currently requires PowerShell.

Step 1: Create a Service Principal

This step registers the application and its unique identifiers within Exchange Online. This must be done once per Azure tenant.

PowerShell Command:

New-ServicePrincipal -AppId xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -ObjectId dd147429-bf6d-4562-b12b-b05c580c1c82 -DisplayName "Einstein Activity Capture"

Note: When specifying the -AppId and -ObjectId parameters, retrieve these values from the Salesforce Enterprise Application created during the Einstein Activity Capture (EAC) consent process in Microsoft Entra ID. To locate the required values, navigate to Microsoft Entra ID > Enterprise applications and select the Enterprise Application generated when EAC consent was granted. Custom Azure/Entra applications are not supported, as EAC relies exclusively on a fixed, Salesforce-owned Enterprise Application for all Microsoft connection methods.

Step 2: Define a Management Scope

A Management Scope groups the target users (mailboxes) using a RecipientRestrictionFilter based on user attributes (e.g., CustomAttribute1, Department).

Example A: Grouping by Custom Attribute The scope "EAC" targets mailboxes where CustomAttribute1 equals 'EAC_CEM'.

PowerShell Command: New-ManagementScope -Name "EAC" -RecipientRestrictionFilter "CustomAttribute1 -eq 'EAC_CEM'"

Example B: Grouping by Department The scope "RBAC Users Department" targets mailboxes where the Department equals 'RBAC Users'.

PowerShell Command:  New-ManagementScope -Name "RBAC Users Department" -RecipientRestrictionFilter "Department -eq 'RBAC Users'"

Step 3: Management Role Assignment (Adding Scopes)

This step links the Application (using the Object ID), the desired Graph API Role (prefixed with Application), and the Management Scope (defined in Step 2).

Role Assignments for Full Access to "EAC" Scope These commands grant Read, Write, and Send permissions for Contacts, Calendars, and Mail to the Service Principal, limited only to users in the "EAC" scope.

PowerShell Command: 
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Mail.Send" -CustomResourceScope "EAC"
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Mail.Read" -CustomResourceScope "EAC"
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Calendars.ReadWrite" -CustomResourceScope "EAC"
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Calendars.Read" -CustomResourceScope "EAC"
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Contacts.ReadWrite" -CustomResourceScope "EAC"
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Contacts.Read" -CustomResourceScope "EAC"

Alternative: Limited Access for "RBAC Users Department" Scope This grants only Calendar and Contacts Read/Write access to users in the specified department, excluding Mail.

PowerShell Command: 
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Calendars.ReadWrite" -CustomResourceScope "RBAC Users Department"
New-ManagementRoleAssignment -App dd147429-bf6d-4562-b12b-b05c580c1c82 -Role "Application Contacts.ReadWrite" -CustomResourceScope "RBAC Users Department"

Step 4: Testing Authorization

Use the Test-ServicePrincipalAuthorization cmdlet to confirm which roles have been successfully applied to a specific user via the RBAC configuration.

PowerShell Command: 
Test-ServicePrincipalAuthorization -Identity "Einstein Activity Capture" -Resource [user-email-address]

Important Note: Access changes via the Graph API may take a significant amount of time (e.g., 30 minutes or more) to propagate and take effect, even if the test command returns positive results immediately

Note: The example provided is for reference purposes only. Any configuration or setup required in Microsoft Azure or Entra ID, including application registration, permissions, or scope assignments, is managed by the domain's Microsoft administrator. Salesforce does not configure or support Azure-side components. Customers should follow Microsoft's official documentation when performing these steps.