topic Re: OAuth for Office 365 - Unity Connection 12.5 SU2 in Collaboration Applications

OAuth for Office 365 - Unity Connection 12.5 SU2

mloraditch — Tue, 04 Feb 2020 15:11:47 GMT

This just came out yesterday so this is more directed for anyone lurking at Cisco, but how is this supposed to work?

Our UM has been disabled for months because of MS security requirements for resellers that broke the old way so I quickly installed this in my test lab to see if it will fix my issue.

According to all the MS documentation there should be no need to use the old Autodiscover, etc that Unity was using. You just connect to the default outlook.office365.com EWS url and use your oauth info and boom. The whole point is to not have to setup an account with special permissions, etc.

However, the fields for the old account are still there and mandatory and all the test options are going through and failing Autodiscover…

If I look at the Mailbox Sync Logs I don’t see any evidence it’s trying to use Oauth/EWS.

Anyone in the know out there?

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Vaijanath Sonvane — Wed, 05 Feb 2020 12:43:35 GMT

Hi,

As per Cisco documentation, for using OAuth2 web authentication mode, you must create and register an application on Microsoft Azure portal corresponding to the Unified Messaging Service. Please refer below document for detailed steps:

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/12x/unified_messaging/b_12xcucumgx/b_12xcucumgx_chapter_01.html#id_25193

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Jon Snipes — Tue, 10 Mar 2020 13:37:15 GMT

I'm seeing the same thing. Azure app built etc, but when you test the connection it fails on autodiscover. Any update on this one or is the failure expected?

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

awentland — Thu, 09 Apr 2020 11:21:23 GMT

Did anyone resolved problem with autodiscovery? With basic authentication it looks fine, but when I only activate and switch into oauth2 it stops autodiscovering... On user configuration page it says "Unable to locate an Exchange server at which to access email_address"

I went through the provided guide, but I get the same result as Jon.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Lukasz Pilatowski — Thu, 09 Apr 2020 12:11:23 GMT

We have same error - basic works, but when switching to OAuth2 ... autodiscovery error.

So mostly another case for TAC and to go trought logs 😄

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

jbreeden11 — Mon, 01 Jun 2020 18:10:23 GMT

I have the same issue.

I noticed the addresses do not match between Basic and oAuth

oAuth uses:

https://autodiscover.outlook.office365.com/autodiscover/autodiscover.xml

Basic uses:

https://OUTLOOK.OFFICE365.COM/autodiscover/autodiscover.xml

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

mloraditch — Thu, 04 Jun 2020 21:33:49 GMT

See above for my settings screen. This is working.
Things of note, my account is a dedicated one created on our non primary domain that DOES NOT have sso enabled.
Further if you have conditional access enabled with MFA you may need to bypass the default that blocks legacy items and create a special exception just for your UM Account. Somehow the initial process still uses some sort of legacy authentication then switches to oauth.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

jbreeden11 — Fri, 05 Jun 2020 15:33:50 GMT

I had a support call with Cisco:

Ultimately we had to change the password on the service account:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt29541

Mine had a special character in it.

We changed the password to just Uppercase, Lowercase and numbers.

Then we deleted the Unified Messaging Service Account in Unity Connection and then Added it back in with a Different Name.

Mine is now working

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Jacob190000 — Fri, 29 Jul 2022 19:22:30 GMT

This resolved the issue I was having with 12.5.X as well. I will note that it did not work initially I had to try a couple times including building a new profile. However I think what ended up causing it to finally work was selecting the "Reset" next to "Synchronize Connection and Exchange Mailboxes (Single Inbox)" and then my test finally succeeded in connecting.I was also able to get it to work with my original profile which made it simpler.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

whatuusay1 — Thu, 06 Oct 2022 18:19:37 GMT

So for those of you struggling with poor email delivery and MWI times this is because Cisco is recommending you use the EWS API's which are terrible (and slow). The correct API's to use within the Oath Application process should be Graph API's (EWS will be deprecated soon anyways). Here's the permissions to use for Graph. The performance improvements are staggering (5 minute delivery and MWI times with EWS vs 15 seconds with Graph). Your Microsoft admins will thank you.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

mgayle083 — Mon, 17 Oct 2022 16:36:21 GMT

I am in the process of creating the Application, should I remove all permissions from the Office 365 section or can I leave the permissions in both?

Also, if some users need to check voicemail on a share box, do I need to have the mail.readwrite.shared?

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

HighwayCO — Wed, 25 Jan 2023 15:11:13 GMT

I recently found that if using a third-party Authentication provider (Duo Authentication, etc.), you will need to create an <domain>.onmicrosoft.com service account and give the necessary permissions to Impersonate as well as give permissions to the application itself Azure Active Directory > Enterprise Applications > (Application Name) > Users and Groups

Hope this additional information saves others the hours of authentication t-shooting we just went through... 😕

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

burb19722 — Tue, 31 Jan 2023 14:33:10 GMT

on 12.5 we dont show the oauth2 in the drop down menu, does it magically appear when you add the azure? or are there certain versions of 12.5 that show oauth2 in the drop down? I did upgrade one customer to 11.5 su 11 and it had the oauth2 in the drop down. Thanks in advance

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

jbreeden11 — Tue, 31 Jan 2023 14:56:19 GMT

Cisco Unity Connection 12.5(1) SU2 and later supports OAuth2 authentication mode for configuring Unified Messaging with Office 365.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

piyush aghera — Tue, 31 Jan 2023 23:15:24 GMT

Not sure if you have already resolved this issue and for information to others, I have consolidated steps to enable and configure OAuth 2.0 with Cisco Unity Connection Unified messaging.

Here are the steps in summary:

Verify Unity Connection for OAuth support
Service Account in AD/Office365
Register an application in Microsoft Azure
Configure CUC Unified messaging for OAuth 2.0

Please refer my blog below for steps in detail: https://voiptechwikis.com/unified-messaging-oauth/

Thanks.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Saima Harris — Wed, 10 Apr 2024 17:46:39 GMT

Hi,

My customer is planning to migrate from EWS to Microsoft Graph.

We need to know if there is anything from Cisco Unified perspective that we need to be aware of or update.

Is there any Cisco guide for Cisco UCxn to work with and Microsoft Graph

Thank you

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Roger Kallberg — Wed, 10 Apr 2024 18:06:30 GMT

From what I know CUC version 14 SU3 and onwards uses Graph instead of EWS.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Liz Bentler — Wed, 22 May 2024 18:56:20 GMT

Is there any documentation showing 14 SU3 uses graph instead and how to configure?

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Saima Harris — Wed, 22 May 2024 19:14:18 GMT

Hi Liz,

This is the response I received from TAC:

The retirement of EWS would be until October 1st, 2026.
As you can confirm in this article from Microsoft:
https://techcommunity.microsoft.com/t5/exchange-team-blog/retirement-of-exchange-web-services-in-exchange-online/ba-p/3924440

But as for today, Unity still doesn’t support Graph, it only supports EWS.
And for the version you have today is 14SU3, you only need the following change:
a. (Applicable to 14SU3 and later releases) Click Application permissions and add full_access_as_app permission in your application. To restrict the permissions, see steps mentioned inTask List for restricting Application Permissions to mailboxes.

But since you have it already because of O365, then there is no change needed from your side regarding this change.
As you can confirm here:
https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/14/unified_messaging/guide/b_14cucumgx/b_14cucumgx_chapter_01.html#ID-2370-000005f5

For Graph the Developers from Cisco side are still doing tests to confirm if it would be possible to use it in a future.
But for now as I previously mentioned, is not supported.

Re: OAuth for Office 365 - Unity Connection 12.5 SU2

Roger Kallberg — Wed, 22 May 2024 19:21:50 GMT

It is described in this document. Unified Messaging Guide for Cisco Unity Connection Release 14