---
title: "Configure the connection for Microsoft delegation synchronization"
description: "Help with configuring automatic delegations by Microsoft"
url: https://support.signitic.com/en/articles/9561126-configure-the-connection-for-microsoft-delegation-synchronization
collection: "Get started with Microsoft 365"
updated: 2026-11-03
language: en
alternates: [fr, pt, it, de]
---

# Configure the connection for Microsoft delegation synchronization

Help with configuring automatic delegations by Microsoft

This guide explains how a Microsoft 365 administrator can authorize Signitic to read the **Send As** and **Send on Behalf Of** rights of shared mailboxes.

Signitic has read-only access. The solution does not create, modify, or revoke any delegation rights in Microsoft 365.

## Permissions used by Signitic

Upon login, the enterprise application **Signitic - Delegation Synchronization** requests the following Office 365 Exchange Online application permissions:

-   `Exchange.ManageAsApp`, used by the current synchronization;
    
-   `Exchange.ManageAsAppV2`, included to prepare for future Exchange Online integration improvements.
    

These permissions allow Signitic to authenticate with Exchange Online. By themselves, they do not grant access to Exchange data: a read-only role assignment is also required.

The existing Signitic Microsoft 365 connector uses its Microsoft Graph application permission `Domain.Read.All` to identify your tenant's `onmicrosoft.com` domain. The application dedicated to delegations does not require an additional Microsoft Graph permission for this operation.

## Before you begin

You must have:

-   of an administrator account belonging to the same Microsoft tenant as the Signitic connector;
    
-   of the right to grant administrator consent at the organization level;
    
-   of the right to assign the Microsoft Entra role **Global Reader** to an enterprise application.
    

A Privileged Role Administrator (_Privileged Role Administrator_) or a Global Administrator (_Global Administrator_) can perform this assignment.

These privileges are necessary only for the person performing the configuration. Do not assign the **Global Administrator** or **Exchange Administrator** roles to the Signitic enterprise application.

## Step 1 — Authorize synchronization in Signitic

1.  In Signitic, go to **Settings > Connectors**.
    
2.  Edit the Microsoft 365 connector.
    
3.  In the **Synchronize delegations** section, select **Synchronize**.
    
4.  Sign in with an administrator account from the same Microsoft tenant as the connector.
    
5.  Review the requested Office 365 Exchange Online application permissions.
    

Grant admin consent for your entire organization.

![](https://staticfiles.gleap.io/ghelparticle/eTuQyrzx26L6aLqcacr9fihzGId4UuuMYSVeZOERhkV84oFHhB1p396C7DlBQWGn4zt6rj1hBzt.png)

## Step 2 — Verify admin consent

1.  Open the [Microsoft Entra administration center](https://entra.microsoft.com/).
    
2.  Go to **Enterprise applications > Signitic - Delegation Synchronization > Permissions**.
    
3.  Verify that admin consent is granted for:
    
    -   `Exchange.ManageAsApp` ;
        
    -   `Exchange.ManageAsAppV2`.
        

Both permissions must be granted in the same Microsoft tenant used by the Signitic connector.

## Step 3 — Assign Exchange read permissions

You must choose **only one** of the following two configurations:

-   **Step 3.1 — General reader**: simple and quick configuration.
    
-   **Step 3.2 — Exchange RBAC**: recommended configuration applying the principle of least privilege.
    

These two configurations are alternatives: it is not necessary to combine them.

### Step 3.1 — Assign the Global Reader role

The **Global Reader** role (_Global Reader_) provides read access to the Microsoft 365 administration information necessary for synchronization. It does not allow Signitic to modify delegation rights.

In the [Microsoft Entra administration center](https://entra.microsoft.com/):

1.  Go to **Roles and administrators > All roles**.
    
2.  Search for and open **Global Reader** (_Global Reader_).
    
3.  Select **Add assignments**.
    
4.  Search for **Signitic - Delegation Synchronization**.
    
5.  Select the enterprise application and confirm the assignment.
    
6.  Verify that the assignment targets the enterprise application, not the administrator performing the configuration.
    

The Global Reader role provides read access to administration information across multiple Microsoft 365 services. It is not limited to Exchange Online.

### Step 3.2 — Configure limited Exchange RBAC access

This configuration is recommended to apply the **principle of least privilege**. It limits the Signitic application's permissions to Exchange recipient information necessary for synchronization.

The application receives only the Exchange role:

-   **View-Only Recipients** (_View only recipients_).
    

#### Prerequisites

The administrator performing the configuration must be able to manage Exchange role groups. In particular, they must have the **Role Management** role (_Role management_).

If your organization uses Microsoft Entra Privileged Identity Management (PIM), temporarily activate your **Exchange Administrator** role before you begin.

These rights are necessary only for the administrator performing the configuration. They must not be assigned to the Signitic application.

#### Retrieve application identifiers

In the [Microsoft Entra administration center](https://entra.microsoft.com/):

1.  Go to **Enterprise applications**.
    
2.  Open **Signitic - Delegation Synchronization**.
    
3.  In **Overview**, copy:
    
    -   the **Application ID**;
        
    -   the **Object ID**.
        

Be sure to use the Object ID of the **enterprise application** present in your Microsoft 365 environment.

#### Create the Exchange role group

In the [Exchange administration center](https://admin.exchange.microsoft.com/#/adminRoles):

1.  Go to **Roles > Administrator Roles**.
    
2.  Select **Add Role Group**.
    
3.  Enter:
    
    -   name: `Signitic Delegation Readers` ;
        
    -   description: `Read-only access used by Signitic delegation synchronization`.
        
4.  Keep the write scope proposed by default.
    
5.  Select only the **View-Only Recipients** role.
    
6.  Verify the configuration, then create the group.
    

#### Add the application to the role group

Open PowerShell with the Exchange administrator account, then connect to Exchange Online:

```javascript
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -Device
```

Create the Exchange service principal reference by replacing the values in angle brackets:

```javascript
$signiticServicePrincipal = New-ServicePrincipal `
    -AppId "<ID_APPLICATION_SIGNITIC>" `
    -ObjectId "<ID_OBJET_APPLICATION_ENTREPRISE_SIGNITIC>" `
    -DisplayName "Signitic delegation"
```

If the reference already exists, retrieve it with:

```javascript
$signiticServicePrincipal = Get-ServicePrincipal `
    -Identity "<ID_OBJET_APPLICATION_ENTREPRISE_SIGNITIC>"
```

Then add the application to the role group:

```javascript
Add-RoleGroupMember `
    -Identity "Signitic Delegation Readers" `
    -Member $signiticServicePrincipal.Identity
```

Verify that the application belongs to the group, then close the connection:

```javascript
Get-RoleGroupMember -Identity "Signitic Delegation Readers"

Disconnect-ExchangeOnline -Confirm:$false
```

The result of `Get-RoleGroupMember` must contain the reference of the Signitic application.

## Step 4 — Validate the configuration

1.  Wait a few minutes (up to 30 minutes) for the Microsoft Entra and Exchange Online permissions to propagate.
    
2.  Return to the Microsoft 365 connector in Signitic.
    
3.  Select **Validate permissions**.
    

Once validation is successful, delegation synchronization is enabled. It runs after each successful import of Microsoft users.

## Troubleshooting

If validation fails, check the following points:

-   the administrator consent for `Exchange.ManageAsApp` and `Exchange.ManageAsAppV2` has been granted;
    
-   the permissions have been granted in the same Microsoft tenant as the Signitic connector;
    
-   the Microsoft 365 connector has been authorized in this tenant;
    
-   the **Global Reader** role is assigned to the enterprise application **Signitic - Delegation Synchronization**, and not to an administrator user;
    
-   sufficient time has been allowed for the propagation of permissions and the role;
    
-   the conditional access or workload identity policies allow the Signitic application to access Exchange Online.
    

Do not attempt to resolve a validation failure by assigning the Global Administrator or Exchange Administrator roles to the Signitic application.

If validation still fails, contact Signitic support by providing the connector name and the approximate time of validation. Never transmit an access token.