Microsoft 365

Step 1: Register an app

In Microsoft Entra admin center → Entra ID → App registrations → New registration, name the app Myrikeep scanning agent, choose Accounts in this organizational directory only and leave redirect URI blank. Record Application (client) ID and Directory (tenant) ID from Overview.

Open Certificates & secrets → Client secrets → New client secret. Choose an expiry your team can maintain, copy the Value once, and set a rotation reminder before expiry. The Secret ID is not the credential.

Step 2: Grant read access for your chosen source

Exchange Online mail

Use Exchange Application RBAC to scope Application Mail.Read. As an Exchange admin, install/use Microsoft's Exchange Online PowerShell tools and connect. Replace the placeholder IDs; the service-principal Object ID comes from Enterprise applications, not the app-registration Object ID. This example uses an unused mailbox custom attribute; agree the attribute with your Exchange admin before setting it:

Connect-ExchangeOnline
Set-Mailbox -Identity [email protected] -CustomAttribute15 MyrikeepScan
New-ServicePrincipal -AppId '<APPLICATION_CLIENT_ID>' -ObjectId '<ENTERPRISE_APP_OBJECT_ID>' -DisplayName 'Myrikeep scanning agent'
New-ManagementScope -Name 'Myrikeep mailboxes' -RecipientRestrictionFilter "CustomAttribute15 -eq 'MyrikeepScan'"
New-ManagementRoleAssignment -App '<ENTERPRISE_APP_OBJECT_ID>' -Role 'Application Mail.Read' -CustomResourceScope 'Myrikeep mailboxes'
Test-ServicePrincipalAuthorization -Identity '<ENTERPRISE_APP_OBJECT_ID>' -Resource [email protected]

Tag only intended mailboxes. Test a mailbox inside and outside the scope. Remove any separately granted Entra Mail.Read application permission: grants are additive, and the RBAC test excludes Entra permissions. Allow propagation time before a real scan. Older Application Access Policies are a separate, legacy mechanism; do not treat them as RBAC role assignments. Follow Microsoft's Application RBAC guide.

OneDrive for Business

Open API permissions → Add a permission → Microsoft Graph → Application permissions. Add Files.Read.All, then Grant admin consent for your tenant. This grants broad file access across the tenant. Selecting one user or folder in Myrikeep narrows scanning, not the app's authority. Use a dedicated app and review whether this broad permission suits your workspace. Do not add write or directory permissions. See Graph Files.Read.All.

SharePoint document library

In the same application-permissions dialog add Sites.Selected, then grant admin consent. Consent alone grants no site access. Using a separate authorized admin tool or Graph Explorer session, grant the scanning app read access to only the selected site:

POST https://graph.microsoft.com/v1.0/sites/<SITE_ID>/permissions
Content-Type: application/json

{"roles": ["read"], "grantedToIdentities": [{"application": {"id": "<APPLICATION_CLIENT_ID>", "displayName": "Myrikeep scanning agent"}}]}

Do not grant the scanning app administrative rights to grant itself access. See Selected permissions. For a SharePoint-only app, avoid Files.Read.All or Sites.Read.All, which would broaden access beyond the selected-site grant.

Step 3: Find scope IDs and add the connection

Use mailbox email addresses for mail and a user's UPN or object ID for OneDrive. For SharePoint, an admin can use Graph Explorer to look up the site and library:

GET https://graph.microsoft.com/v1.0/sites/example.sharepoint.com:/sites/Finance
GET https://graph.microsoft.com/v1.0/sites/<SITE_ID>/drives

Copy the first result's id as Site ID, then the intended library's id as Drive ID. These are provider IDs, not browser URLs. The agent never lists all sites or users. In Connections → Add connection, select the corresponding Microsoft 365 type, enter its scope, assign the agent and choose Local credential catalog. Prepare the secret below, wait for present, then queue a scan in Scans.