Microsoft Exchange
1. Navigate to the Integrations page within Ploy
Click on 'Ploy' in the bottom left and select integrations.
2. Configure Microsoft Exchange
Select 'Configure' on Microsoft Exchange, enter your tenant domain and select 'Authenticate'.
Select 'Grant Permission' and follow the steps to sign in to your Microsoft Account.
3. Grant least-privilege access
Ploy uses a least-privilege role group in Exchange Online instead of a broad administrator role. To set this up:
In the Microsoft Entra admin center, go to Enterprise applications, open Ploy (Exchange), and copy its Object ID ā the Enterprise applications value, not the App registrations one.
Paste that Object ID into the Enterprise application Object ID field in the Ploy setup step; the PowerShell script fills in automatically.
Open PowerShell with the Exchange Online Management module installed, run
Connect-ExchangeOnline, and sign in as an administrator.Copy the script from the Ploy setup step and run it. It creates a role group called Ploy Exchange granting three roles ā Mail Recipients, Distribution Groups and Mail Recipient Creation ā registers the Ploy service principal in Exchange, and adds it to that role group.
Finish setup in Ploy.
Key Permission Requirement
Ploy requires three Exchange RBAC roles:
Mail Recipients
Distribution Groups
Mail Recipient Creation ā needed only for the delete a shared mailbox action (it is the role that permits
Remove-Mailbox). Ploy's reads and its other actions work without it.
These are assigned through the custom Ploy Exchange role group created by the Ploy setup script. No tenant-wide Exchange Administrator role is required or recommended.
If you set Ploy up before Mail Recipient Creation was added to the script, the delete-shared-mailbox action will fail with a message asking you to add the "Mail Recipient Creation" role to the "Ploy Exchange" role group. To add it, run Connect-ExchangeOnline and then:
Set-RoleGroup -Identity "Ploy Exchange" -Roles "Mail Recipients","Distribution Groups","Mail Recipient Creation"
If you never intend to let Ploy delete shared mailboxes you may leave that role out; only that one action is affected.
Exchange RBAC changes can take up to ~30 minutes to apply. If a connection test run immediately after setup fails, wait and retry.
What Ploy can and can't do in Exchange
This section sets out exactly what the integration is able to do through those three roles, so it can be shared with your security, change-control, or audit teams.
What Ploy reads
Mail recipients (mailboxes, mail users, contacts) ā users with no mail address are skipped
Distribution list membership ā distribution lists only; Microsoft 365 groups and security groups are filtered out
Shared-mailbox access, linking shared mailboxes to their backing directory user (when a Microsoft integration is also connected)
What Ploy can action
Where a review outcome or workflow changes access, Ploy can:
Add or remove distribution list members
Grant or revoke shared-mailbox delegate access (full access, send-as, auto-mapping)
Manage mailbox state: convert a mailbox to shared, delete a shared mailbox (requires the Mail Recipient Creation role), or hide a mailbox from the global address list
What Ploy cannot do
The Exchange integration cannot create, remove, suspend, or modify user accounts ā identity lifecycle stays entirely with the Microsoft (Entra) integration. It cannot manage licences or admin roles, and it has no access to mailbox content, messages, calendars, or attachments. There is a deliberate split of responsibilities: Microsoft owns the identity lifecycle; Exchange owns what happens to mailboxes and distribution lists.
Video Tutorial
For more info, you can watch a short tutorial video here.