Skip to main content

Connect Microsoft Exchange to Anzenna

Connecting Microsoft Exchange lets Anzenna check what happened to encrypted email your organization sent, and withdraw a recipient's access to it.

This is a separate connection from Microsoft 365, using its own Microsoft Entra application.

Prerequisites​

  • Advanced Message Encryption. Included with Office 365 E5/A5/G5, Microsoft 365 E5/A5/G5, and the Microsoft 365 E5 Compliance and E5 Information Protection and Governance add-ons. Message tracking and revocation do not exist on Office 365 E3 or Business plans.

  • A Global Administrator, Privileged Role Administrator, or Cloud Application Administrator, to approve the connection

  • An Exchange administrator, to grant the application its Exchange role

  • Exchange Online PowerShell

To confirm your organization has Advanced Message Encryption, connect to Exchange Online PowerShell and run:

Connect-ExchangeOnline
Get-Command -Noun OME*

Five commands mean Advanced Message Encryption is available. If you see only Get-OMEConfiguration and Set-OMEConfiguration, your subscription does not include it and the rest of this guide will not work.

Step-by-Step Instructions​

Part 1: Approve the connection​

  1. In Anzenna, go to Configurations and select Microsoft Exchange.

The Microsoft Exchange card in Configurations, not yet connected

  1. Sign in with an administrator account when Microsoft prompts you.

  2. Review the permissions and select Accept. Anzenna requests application permissions on Office 365 Exchange Online, plus sign-in and profile read so the connection can identify your tenant. It requests no access to mail, files, or directory data through Microsoft Graph.

The Microsoft consent dialog listing the requested Exchange permissions The Microsoft Exchange card showing as connected

The connection shows as active once this completes. It is not usable yet. Exchange grants its own permissions separately, which is Part 2.

Part 2: Grant the Exchange role​

Exchange maintains a permission system of its own and does not inherit anything from Part 1. The application has to be registered with Exchange and given a role there before it can run any command. This is a one-time setup and must be done in PowerShell. The Exchange admin center's role screens accept only users and groups, not applications.

  1. In the Microsoft Entra admin center, go to Enterprise applications and search for Anzenna Integration. Open it and copy both the Application ID and the Object ID from the Overview page.

  2. Take both values from Enterprise applications, not from App registrations. Both list the same application and both show an object ID, but they are different values and only the first one works here.

Searching for Enterprise applications in the Entra admin center The application Overview page showing Application ID and Object ID

  1. Register the application with Exchange, using the two values from above.

Connect-ExchangeOnline

New-ServicePrincipal `
  -AppId "<Application ID>" `
  -ObjectId "<Object ID>" `
  -DisplayName "Anzenna Exchange"

  1. Give it a role that covers message tracking and revocation.

Add-RoleGroupMember -Identity "Compliance Management" -Member "Anzenna Exchange"

Compliance Management exists in every organization and carries both roles Anzenna needs: Information Rights Management, which covers reading and revoking encryption status, and Message Tracking, which is how Anzenna finds a message when it has not been given the Message-ID. If you prefer a dedicated group, it must contain both: a group with only Information Rights Management leaves message lookups failing.

  1. Confirm the role was applied.
Get-ManagementRoleAssignment -RoleAssignee "Anzenna Exchange" | Select-Object Role

Information Rights Management should appear in the list. Exchange can take several minutes to apply a new role assignment.

Part 3: Add a branding template​

Microsoft requires a custom branding template to guarantee that encrypted messages can be tracked and revoked. Message lookups work without one, so this part is easy to skip. Set it up before you rely on revocation.

  1. Check whether your organization already has a custom template.

Get-OMEConfiguration | Select-Object Identity

OME Configuration is the default template and does not count. If it is the only entry, create a custom one:

New-OMEConfiguration -Identity "Your organization" -ExternalMailExpiryInDays 90

ExternalMailExpiryInDays is optional and sets how long external recipients can open the message through the portal.

The remaining steps apply only if you encrypt through a rule or policy. A mail flow rule attaches your template to messages automatically. Messages a sender encrypts by hand in Outlook with Encrypt Only are revocable without one, so skip the rest of this part if that is how your organization sends encrypted mail.

  1. In the Exchange admin center, go to Mail flow > Rules and create a new rule.

  2. Under Apply this rule if, select The sender is located inside the organization.

  3. Under Do the following, select Modify the message security > Apply custom branding to OME messages, then choose the template.

If you already have a rule that applies encryption, keep it at a higher priority than this one so messages are encrypted before branding is applied.

Which messages can be tracked and revoked​

Only encrypted messages. Revoking works by switching off the encryption portal link, so a message sent without encryption has nothing to withdraw. Anzenna reports no encrypted message found. Outlook's Message Recall is a different feature and is not what Anzenna uses.

Among encrypted messages, the recipient decides, not the sender. Microsoft delivers one of two ways, and only one of them can be revoked:

  • Revocable. Recipients on Gmail, Yahoo, and other non-Microsoft mail get a link to the encryption portal. That link is what revoking switches off, provided the branding rule from Part 3 was in place when the message was sent.

  • Not revocable. Recipients on Microsoft 365 or Outlook.com open the message directly in Outlook. There is no portal link to withdraw, so Microsoft offers no way to revoke it.

Anzenna reports a message in the second group as not revocable rather than failing. Message status can be looked up either way.

Revocation applies to the message, not to a recipient. There is no way to withdraw access from one person and leave it for another. On a message with recipients of both kinds, revoking closes the portal for everyone who got a link and changes nothing for those who opened it inline in Outlook, who keep their copy. Treat a mixed message as only partly withdrawn.

What revoking does​

A recipient outside your organization does not receive the message itself. They receive a wrapper with a button that opens it in Microsoft's encryption portal, which is what revoking switches off.

The Read the message button a recipient receives

Once revoked, that button stops working. Microsoft shows a generic failure rather than saying the message was revoked, so a recipient cannot tell the difference between a withdrawn message and a portal problem, and neither can you, from their side alone. Confirm a revocation from its status in Anzenna, not from what the recipient sees.

The encryption portal refusing to display a revoked message

It does not recall or delete the message, and it does not undo a read that already happened. Anyone who opened it before revocation still read it, and any copy they saved remains theirs. Revocation cannot be reversed.