Using the Microsoft Exchange Online extension

The CloudRadial AutomationAI Microsoft Exchange Online extension automates Exchange Online administration, from releasing a quarantined message to tracing mail flow and managing mailbox settings. This article covers what the extension can do, the app registration and credentials it needs, how its approval gate works, and the Exchange assistant agent that ships with it. It is for Admins and Owners.

• What the Extension Covers
• Creating the App Registration
• Choosing a Directory Role
• Providing the Credentials to Your Runner
• Reads and Approval-Gated Changes
• The Exchange Assistant Agent
• What the Extension Does Not Do

What the Extension Covers

The extension provides 31 tools across five areas:

Install it from Extensions the same way as any other catalog extension. Adding a capability later is a catalog change rather than anything you install or configure on the runner.

Creating the App Registration

The extension authenticates to the Exchange admin API with an app-only (client-credentials) token, so it runs unattended with no signed-in user. Create a Microsoft Entra ID app registration for it, exactly as you would for the Microsoft 365 extension:

1. Register a new application in the Microsoft Entra admin center. Give it a name you will recognize, such as AutomationAI Exchange Online. No redirect URI is needed.
2. Record the Application (client) ID and the Directory (tenant) ID from the app's Overview page.
3. Create a client secret under Certificates & secrets and copy its value before you leave the page. Microsoft shows it only once.

One app registration and one set of credentials serve every capability listed above, because they all reach the same Exchange admin endpoint.

Choosing a Directory Role

The role you assign the app registration determines which tools will work:

• Exchange Administrator covers every tool in the extension
• Security Administrator covers quarantine and protection policy, but not recipient, mailbox, or connector management. Seven read tools return a permission error under this role.

If you intend to use the extension only for quarantine work, Security Administrator is the narrower choice. Assign Exchange Administrator if you want the full tool set.

Providing the Credentials to Your Runner

Store three secrets in your runner's Key Vault with these exact names:

For how to add these, see the article on updating secrets in your runner's Key Vault. The tenant ID is supplied to every call from the vault rather than from the automation itself, so an agent cannot direct a tool at a different tenant.

Reads and Approval-Gated Changes

Of the 31 tools, 18 are read-only and run without interruption. The remaining 13 change something and are approval-gated: the run pauses and the request appears as an Action Required item in the Inbox until someone approves it. See the article on handling Action Required items in the Inbox.

Recipient scoping is enforced by Exchange itself rather than by how a request is worded, and the release-to-all option is fixed rather than something an automation can choose.

The Exchange Assistant Agent

The extension ships with an Exchange assistant agent you can install from the agent catalog and bind to an Agent node. It is set to preview changes by default, so it plans an action and shows you what it would do rather than acting immediately. A quarantine check-and-release workflow template is also available to import as a starting point.

What the Extension Does Not Do

Some operations are deliberately excluded because their blast radius is tenant-wide:

• Transport rules can be enabled and disabled, but not created or deleted
• Protection policies can be read, but not edited
• There is no general-purpose tool for running an arbitrary Exchange command

If you are still having trouble, we're here to help! Submit a ticket for assistance, and don't forget to check our status page to ensure there are no outages in your area.