SPARK utilizes a System Assigned Managed Identity (SAMI) and a Registered Application to manage SPARK components within Exchange. The SAMI and Registered Application are represented within Exchange as service principals. They must be restricted in scope.

Requirements

The Exchange Administrator will be required for this step. The user must have:

  • Exchange Administrator role
  • Access to the Microsoft Exchange admin center

Reference Link

Step 1: View Enterprise Applications

Use the correct URL for your environment:

Environment Login URL
Worldwide (Commercial) https://entra.microsoft.com
GCC https://entra.microsoft.com
GCC High https://entra.microsoft.us
DoD https://entra.microsoft.us
  1. Select Enterprise apps from the left menu
  2. Click on All applications under Manage
  3. Click on the X for each default filter
View App Registrations

[!IMPORTANT] If you do not clear the filters, you may not be able to see the automation account

Step 2: View Automation Account SAMI

  1. Search for aa-spark
  2. Click on the aa-spark-automation0 enterprise application
View Automation Account

3. Annotate the Application ID and Object ID values

App Information

[!NOTE] Annotate the following variables in the template spreadsheet:

  • SAMI appId: The application id of the aa-spark-automation0 enterprise application
  • SAMI objID: The object id of the aa-spark-automation0 enterprise application

Step 3: Get App Registration Send Mail Information

  1. Select Enterprise apps from the left menu
  2. Search for sendmail
  3. Click on the appreg-spark-sendmail application registration
View Send Mail App Registration

4. Annotate the Application (client) ID and Object ID values

Send Mail App Registration

[!NOTE] Annotate the following variables in the template spreadsheet:

  • v_exo_sendEmailApp: The application id of the appreg-spark-sendmail enterprise application
  • SendMail appID: The application id of the appreg-spark-sendmail enterprise application
  • SendMail objID: The object id of the appreg-spark-sendmail enterprise application

Step 4: Restrict aa-spark-automation0 SAMI

Restricts the aa-spark-automation0 SAMI to manage the DL-SPARK-SiteOwners distribution lists.

  1. Reference the 01_Restrict_SAMI_aa_spark_automation0_DL_MGT_v01
  2. Uncomment the appropriate connection string based on your tenant
  3. Edit the script and update the following variables listed in the table below
  4. Run the script
Name Value
$appID The application id of the aa-spark-automation0 enterprise application
$objID The object id of the aa-spark-automation0 enterprise application

[!NOTE] These values were retrieved in Step 2: View Automation Account SAMI above.

Step 5: Restrict aa-spark-sendmail Enterprise Application

Create the management scope to restrict the SendMail registered app to send only from the SPARK notifications Shared Mailbox (NPE).

  1. Reference the 02_Restrict_appreg-spark-sendmail.ps1
  2. Uncomment the appropriate connection string based on your tenant
  3. Edit the script and update the following variables listed in the table below
  4. Run the script
Name Value
$appID The application id of the appreg-spark-sendmail enterprise application
$objID The object id of the appreg-spark-sendmail enterprise application