Using Exchange Administrator Role for Microsoft 365 Integration with Global Connection Type
During setup of Match My Email, an Email Service Connection is established. Those that use Microsoft 365 can choose to create a company-level connection that empowers a Salesforce Administrator to manage Users seamlessly. End Users are not required to perform any steps. Initially, Match My Email will need the Global Administrator to initially grant access for the application as a whole with the specified permissions.
Match My Email does not store any credential or access tokens of the Microsoft 365 integrated User. In the Control Panel > Company > Salesforce Connection, the username is shown for informational purposes only. After permissions are granted, no Global Administrator User privileges are stored. The only thing that remains assigned to the Match My Email application is the specifically granted permissions which are: reading all users list and profiles, reading all users email messages and calendar events.
The strategy to grant access and then replace role:
1) Create one dedicated Microsoft 365 User or use existent User and assign Roles Global Administrator and Exchange Administrator
Visit https://admin.microsoft.com, pick Users menu, select User of choice and make sure Roles Global Administrator and Exchange Administrator are enabled
2) Grant access in Match My Email for Email Service Connection using this Microsoft 365 Global Administrator/Exchange Administrator User.
Visit Match My Email > Settings > Control Panel > Email Services > Click + (Add). Select Microsoft 365 and follow affirmative prompts for Global Administrator. Sign in as the User identity with combined Global Administrator/Exchange Administrator role. Accept Permissions.
3) In Microsoft 365, remove Global Administrator role from the User identity.
Visit https://admin.microsoft.com, pick Users menu, select User of choice and remove role Global Administrator
4) Activate imports for users in Match My Email > Settings > Control Panel > Users.
