Lexolution Permissions for Exchange Online in Microsoft Entra

Lexolution Permissions for Exchange Online in Microsoft Entra

This guide explains how an administrator needs to configure Microsoft Entra so that Lexolution can access calendars and user profiles via the new Exchange integration. These steps apply whether you are creating a new app registration or reusing the existing app registration from the previous SIS-Exchange integration.

Requirements

• The administrator must have a Microsoft 365 account with sufficient rights in the Microsoft Entra Admin Center (at least Application Administrator; for admin consent, possibly Global Administrator).
• The administrator must have write access to the configuration file STP.Kms.Server.exe.config for the Lexolution server service.
• The administrator should have a password manager or another secure place ready to store the client secret.

Step-by-Step Instructions

Sign in to the Microsoft Entra Admin Center

First, sign in at https://entra.microsoft.com using your Microsoft 365 administrator account.

If you are reusing the existing app registration from the previous SIS-Exchange integration, you can skip ahead to the step “Add API Permissions.”

Create or Use an Existing App Registration

Now, go to Entra ID and then to App registrations, and create a New registration.

Choose a clear and descriptive name, e.g., Lexolution.

All other settings (supported account types, redirect URI) can be left at their default values.

Finally, click Register.

After registration, Entra will show a summary of the new app registration with the fields Application (client) ID and Directory (tenant) ID. You will need these values later to configure Lexolution.

Create a Client Secret

In the app registration, open the Certificates & secrets menu and, under the Client secrets tab, click New client secret.

Enter a description and set an expiration period. The maximum is 2 years.

Finally, click Add.

🛈 Note

Please make sure to create a new key before the current one expires, otherwise the connection will stop working.

Save the Client Secret Value

After creating the secret, Entra will display the value of the client secret once in the Value column. You will need this value later to configure Lexolution.

🛈 Note

Be sure to use the Value, not the Secret ID.

The value is only visible immediately after creation and cannot be retrieved again. Make sure to save it right away in a password manager.

Add API Permissions for Microsoft Graph

This step is required even if you are reusing the existing SIS-Exchange app registration.

In the app registration, open the API permissions menu and click Add a permission. Under Microsoft APIs, select Microsoft Graph.

In the next dialog, select Application permissions (not Delegated permissions), since Lexolution runs as a background service without a signed-in user.

Search for and enable the following two permissions, then click Add permissions:

Grant Admin Consent

In the API permissions overview, the administrator must click Grant admin consent for [Tenant] and confirm the dialog.

The administrator should check that both permissions show a green checkmark with Granted for [Tenant] status.

Enter Values into the Lexolution Configuration File

Now, enter the following values into the STP.Kms.Server.exe.config configuration file:

🛈 Note

The configuration file can be encrypted.

Restart the Lexolution KMS Server

The Lexolution server service (STP.Kms.Server.exe) must be restarted so it can log in to Microsoft 365 again with the new credentials and permissions.

Test the Connection

In Lexolution, users can open the Employees view in the Firm section of the navigation.

In the Exchange Calendar ribbon group, you can use the Test mailboxes button to check the connection for the selected employees.