Microsoft Graph API - Application permissions

To use the Microsoft Graph API for Legal Hold email communications, you need to register the RelativityOne Legal Hold application in Entra ID and set your processor type to Graph API (Application) in RelativityOne. For more information on setting your processor type, see Adding email settings.

The Microsoft Graph API is an endpoint used to access data and services across Microsoft services. It is a RESTful web API that performs a variety of tasks. In this case, to send communications as a Microsoft user from Relativity.

Considerations

When leveraging the Graph API, we recommend the following:

• Using the Graph API with Application permissions does not require login from the Legal Hold Settings page.
• Relativity uses the email that's set in the Email From field on the Legal Hold Settings field to send emails and will work is the email if part of the tenant.

Licenses

When leveraging the Graph API, you must use a Microsoft user email address and licensed mailbox, with at least an E3 license.

If you do not have a Microsoft user email address and licensed mailbox, you must create a user with the correct licenses. For more information on creating a licensed user in Microsoft, see Microsoft's documentation.

To use the Graph API, Relativity commercial and Government users need the following Microsoft licenses:

• Relativity commercial users—the Microsoft user and mailbox must have at least an E3 license.
• Relativity Government users—the Microsoft user and mailbox must have at least a GCC Low license. GCC High customers should use Delegated permissions. For more information, Microsoft Graph API - Delegated permissions.

For more information on assigning licenses for users in Microsoft 365 admin center, see Microsoft's documentation.

Requirements

When you have the licenses in place, then you must complete the following steps in order before setting up a Microsoft application to communicate:

1. Registering an Azure application and credentials
2. Adding permissions
3. Creating a client secret
4. Adding email settings

After completing these required steps, you can configure the Microsoft account in RelativityOne.

Registering an Azure application and credentials

To use the Microsoft Graph API, you need to register the RelativityOne Legal Hold application in Entra ID. Authentication requires a reference to a dedicate Azure application that has the appropriate permission. This needs to be done on the client side by an Azure user with sufficient rights.

Before you register an application, you must have a licensed Microsoft user email address and mailbox, with at least an E3 license. For more information, see Requirements.

Start with registering your application in the Azure portal by following the steps below.

For more information on registering an application in Azure, see Microsoft's documentation or Microsoft's authentication documentation.

These steps must be completed by a Microsoft 365 administrator.

1. Open your Azure Portal.
2. Click Microsoft Entra ID (formerly known as Azure Active Directory).
3. Click App registrations.
4. Click New Registration to display the Register an application page.
5. Enter an application name in the Name field.
6. Accept the default setting, Accounts in this organizational directory only, as the supported account type.
7. Click Register.
8. Once the application is registered, make note of the Application (client) ID and Directory (tenant) ID for use later when configuring the data source in RelativityOne Collect.

Adding permissions

Next, from the application's page, add permissions to the web API by following the steps. Commercial and GCC Low users must add Application permissions.

To add application permissions, completed the following steps:

1. Click API Permissions.
2. Click Add a permission.
3. Click Microsoft Graph.
4. Select Application Permissions.
5. Select the following options from the Application Permissions section:
   • Mail – Mail.ReadWrite
   • Mail – Mail.Send
6. Click Add Permission.
7. Click Grant Admin Consent and then click Yes.

Creating a client secret

A client secret from Microsoft Azure AD is needed to integrate Microsoft and Relativity.

To create a client secret:

1. In the left-navigation menu, click Certificates & secrets.
2. Navigate to the Client secrets tab.
3. Click the New Client Secret button.
   
   Do not navigate away from the page once the client secret is created.
4. Populate the Description and Expires fields. You can leave the default, or recommended, values.
5. Click the Add button.
   If the client secret was successfully created, Microsoft will display the Client Secret on the table and the Value field in plain text.
6. Copy the Value field and securely store it.

Microsoft hides the Value field if you leave the page and then come back to get the value. At this point, you cannot copy it.

You can repeat steps 4-5 to generate a new client secret.

After you complete registering your app and have your client secret, you need to add this information to your email settings. For more information, see Adding email settings.

Adding email settings

After completing the required steps in Microsoft, you can then set up the account in RelativityOne.

Before adding email settings, make sure you understand all Considerations and completed all tasks in the Requirements sections.

To set up Microsoft for Legal Hold:

1. Navigate to the Legal Hold Settings page.
2. Click Edit.
3. Select either the Outgoing Email or Incoming Email section.
4. Enter information in the fields. For more information, see Outgoing email fields or Microsoft Graph API - Application permissions.
   
5. Update another section or click Save.

Outgoing email fields

Enter the information you gathered in Microsoft into the following fields:

• Application Client ID—enter the Application Client ID created during registering the Legal Hold application in Microsoft 365.
• Application Client Secret—enter the Application Client Secret created during registering the Legal Hold application in Microsoft 365. For more information, see Creating a client secret.
• Tenant ID/Domain—enter the Domain name of the Microsoft 365 tenant the collection is intended for.
• From Email Address—enter the email address of the account you registered with or an account you gave mailbox permissions to.
• Reply to Email Address—enter the reply to email address. When a custodian clicks reply to a project communication, their reply is sent to this address. See the From Email Address example above.

For more information, see Outgoing email fields.