Installation and Configuration
Microsoft Graph Connector

Introduction

Using the Microsoft Graph connector, all users in your Microsoft Graph instance can be indexed so that they can be found in the Mindbreeze search.

Configuring Microsoft Graph/Azure

Creating the Application in Azure

To enable crawling the Microsoft Graph, a new app must first be created that has the permissions to read Microsoft Graph. This app can be created on portal.azure.com.

To create or register the app, navigate to "Azure Active Directory" -> "App registrations" and click on the "New registration" button:

After the app has been created, a secret must be generated so that the crawler can actually log in. This is normally requested automatically after the app has been created. Otherwise, click on the desired app under "App registrations" -> "Owned applications" and then create the secret under "Certificates & secrets" -> "New client secret".

When creating the secret, you can set the expiration time. We recommend a runtime of 6-12 months, so that the secret is changed regularly.

Note: You must copy the created secret so that you can enter it directly in the Mindbreeze configuration. You can add the secret in the Network tab under the "Credentials" area by clicking on the "Add Credential" button.

When you leave the page, you can no longer have a look at the secret.

Now you have to give the app the required permissions. To do this, navigate to "API permissions". The Microsoft Graph Crawler needs the following Application Permissions in Microsoft Graph:

User.Read.All

After you have given the app the permission, you have to grant "admin consent". Use the button "Grant admin consent for <MyInstance>" for this:

Configuring Mindbreeze

Configuring the index

In the Indices tab, add a new index using the +Add Index button. Select the desired Index Node and Client Service and specify the Microsoft Graph data source in the Data Source field. Then confirm your entries with the Apply button.

Configuring the data source

Now configure the data source.

Legend:

Properties marked with *: mandatory field, these must be configured explicitly
Properties not specially marked: optional fields
Fields marked with (Advanced Settings) are only displayed if the "Advanced Settings" view is enabled in the configuration. This is only necessary in special use cases.

Section „Connection Settings“

In the "Connection Settings" area you can define your Microsoft Graph instance to be indexed. The following options are available:

Setting	Description
Graph Service Root (Advanced Settings)	The endpoint/URL of the Microsoft Graph API. By default, "https://graph.microsoft.com". Change this setting only if you are using a national (non-international) Microsoft Cloud. A list of all available national Microsoft Graph endpoints can be found below.
Azure AD Url (Advanced Settings)	The endpoint/URL to the Azure Active Directory. By default, "https://login.microsoftonline.com". Change this setting only if you are using a national (non-international) Microsoft Cloud. A list of all available national Azure AD endpoints can be found below.
Trust all SSL certificates (Advanced Settings)	Allows the use of non-secured connections, for example for test systems. Must not be enabled in production.
Tenant ID*	The Tenant ID of your Microsoft 365 instance. You can find this on the Overview page of the app you created in Azure.
App ID*	The Application (Client) ID of the app created in Azure.
Client Secret*	The Credential created in the Network tab, which contains the created Client Secret.
Crawler Thread Count	Number of threads used for indexing.
Log All Requests (Advanced Settings)	If this option is enabled, all requests against the Graph API are written to a logfile. Should only be activated for troubleshooting.
Get Metadata From Profile (Advanced Settings)	If this option is enabled, additional Metadata is fetched from the profile endpoint. This information includes, skills, languages, projects, etc.
Include Additional User Info (Advanced Settings)	If this option is enabled, additional information about each user is fetched. More information on which additional metadata will be included can be found below.
Enable Delta Crawl (Advanced Settings)	As long as this option is enabled, the crawler only fetches all users from Microsoft Teams during the first crawl run, after that, only changes to users (new user, user edited, user deleted, etc.) are fetched. With this setting a better performance can be achieved Only deactivate this option if there is an inconsistency between the index and the actual Users in Microsoft Graph.
Use Profile Picture as Thumbnail (Advanced Settings)	If this option is enabled, the user's profile picture in Microsoft Graph will be used as a thumbnail in the Mindbreeze search.

Available national Microsoft Graph endpoints

Endpoint	Link
Microsoft Graph global service	https://graph.microsoft.com
Microsoft Graph for US Government L4	https://graph.microsoft.us
Microsoft Graph for US Government L5 (DOD)	https://dod-graph.microsoft.us
Microsoft Graph China operated by 21Vianet	https://microsoftgraph.chinacloudapi.cn

Available national Azure AD endpoints

Endpoint	Link
Azure AD (global service)	https://login.microsoftonline.com
Azure AD for US Government	https://login.microsoftonline.us
Azure AD China operated by 21Vianet	https://login.chinacloudapi.cn

Section „Authorization Settings“

Setting

Description

Static Access Rules
(Advanced Settings)

Since there are no permissions to view users in Microsoft Graph, no ACLs are set in Mindbreeze. This means that the Microsoft Graph Crawler should generally be used on a public index.

However, if you want to restrict access to certain groups (e.g. only logged-in users, management, HR, etc.), you can do this with the help of this setting. The access rules defined here are set for all indexed users.

The following setting options are available:

Access Check Principal	The principal name to which the access rule should apply (e.g. everyone, user@myorganization.com, Management).
Access Check Action	Here you can select whether access should be granted ("Grant") or denied ("Deny") to the defined principal.

Section “Crawling Constraints”

Setting

Description

Constraints

Constraints can be used to exclude messages via their metadata.

Metadata Key	The name of the metadata to compare the patterns against. This refers to the name of the metadata in the index.
Include Pattern (regex)	Regex pattern, with which the value of the metadata is compared. If the pattern matches, the document is included.
Exclude Pattern (regex)	Regex pattern, with which the value of the metadata is compared. If the pattern matches, the document is excluded.

The following should be noted:

A constraint is only checked if the object has the corresponding metadata set. Otherwise, the constraint is ignored.
Excludes are stronger than includes. If an object is excluded by at least one exclude pattern, it will not be indexed, regardless of whether it matches other include patterns.
If an include pattern is configured for a metadata, any object that has the metadata must match the pattern in order to be indexed.
If only exclude patterns are set for the metadata, the object will be indexed as long as it does not match any exclude pattern.

Additional User Information

If the advanced setting “Include Additional User Info” is enabled, these metadata will be added additionally.

Metadata	Description
mgru_manager	Name of the user’s manager.
mgru_managerId	Reference to the manager.
mgru_onPremisesExtensionAttributes	Item containing all the extension attributes (1-15) (if set).
mgru_onPremisesExtensionAttributes_extensionAttribute<x>	Value of the extension attribute x (if set).

List of requests