Microsoft Exchange

1. Navigate to the Integrations page within Ploy

Click on 'Ploy' in the bottom left and select integrations.

2. Configure Microsoft Exchange

• Select 'Configure' on Microsoft Exchange, enter your tenant domain and select 'Authenticate'.

• Select 'Grant Permission' and follow the steps to sign in to your Microsoft Account.

3. Grant least-privilege access

Ploy uses a least-privilege role group in Exchange Online instead of a broad administrator role. To set this up:

1. In the Microsoft Entra admin center, go to Enterprise applications, open Ploy (Exchange), and copy its Object ID — the Enterprise applications value, not the App registrations one.

2. Paste that Object ID into the Enterprise application Object ID field in the Ploy setup step; the PowerShell script fills in automatically.

3. Open PowerShell with the Exchange Online Management module installed, run Connect-ExchangeOnline, and sign in as an administrator.

4. Copy the script from the Ploy setup step and run it. It creates a role group granting only Mail Recipients and Distribution Groups, registers the Ploy service principal in Exchange, and adds it to that role group.

5. Finish setup in Ploy.

Key Permission Requirement

Ploy requires only two Exchange RBAC permissions:

• Mail Recipients

• Distribution Groups

These are assigned through a custom role group created by the Ploy setup script. No tenant-wide Exchange Administrator role is required or recommended.

Video Tutorial

For more info, you can watch a short tutorial video here.