Enhancement Request: Datacap Support Microsoft Graph App-Only Authentication for Office 365 Email Ingestion Using Client Secret or Certificate-Based Credentials

Customer security teams are increasingly restricting or prohibiting username and password-based authentication for application integrations. Many organizations now require vendors to support modern Microsoft Entra ID authentication patterns, including app-only authentication using confidential client credentials.

Currently, the IBM Datacap Office 365 / Microsoft Graph login action requires direct login using a Microsoft account username and password. This does not meet our customer’s security requirements, as their security policy explicitly prohibits the use of username and password credentials for application integrations.

In addition, Microsoft is deprecating Exchange Web Services (EWS) for Exchange Online, making continued reliance on EWS-based mail ingestion unsustainable. Customers need a supported Datacap path for Microsoft Graph-based Office 365 email ingestion that does not require mailbox username/password authentication.

While IBM IDEA DCAP-I-383 appears related, it does not address our requirement because our customer does not use ex_SetProxy or ex_SetProxy_FullURL. The requested enhancement is specifically for Microsoft Graph authentication using Microsoft Entra ID app-only credentials.

Proposed Enhancement
Add support in IBM Datacap for Microsoft Graph app-only authentication to Office 365 mailboxes using Microsoft Entra ID confidential client credentials. We plan to move Datacap onto the customer's Cloud platform.

The enhancement should support the following authentication options:

1. Client Secret Authentication

   • Tenant ID

   • Application/Client ID

   • Client Secret

   • Mailbox/User Principal Name to monitor

   • Mail folder or folder path to process

2. Certificate-Based Authentication

   • Tenant ID

   • Application/Client ID

   • Certificate thumbprint

   • Secure reference to the private key, certificate store, keystore, or protected certificate file

   • Mailbox/User Principal Name to monitor

   • Mail folder or folder path to process

Certificate-based authentication should be supported as the preferred production option because it aligns better with enterprise security standards than long-lived client secrets.

Microsoft Entra ID Configuration Requirements
The Microsoft Entra ID application should support Microsoft Graph application permissions required for Datacap email ingestion, such as:

• Mail.Read or Mail.ReadWrite, depending on whether Datacap only reads messages or also moves, updates, flags, or deletes processed messages.

• Additional permissions only if required by the Datacap mail-processing use case.

The solution should support admin consent for the Microsoft Entra ID application permissions.

Where application permissions grant broad mailbox access by default, the documentation should recommend that customers restrict the application to approved mailbox scopes using Microsoft-supported Exchange Online application access controls or RBAC mechanisms.

Datacap Configuration Requirements
In the Datacap configuration interface, provide an option to select the Office 365 / Microsoft Graph authentication method:

• Username/password login, for backward compatibility where still permitted

• Microsoft Graph app-only authentication with client secret

• Microsoft Graph app-only authentication with certificate credential

The app-only authentication options should not require an interactive user login or mailbox password.

Security Requirements
The enhancement should ensure that:

• Client secrets are encrypted at rest.

• Certificate private keys are not exposed in plaintext.

• Configuration supports credential rotation.

• Error logging does not expose secrets, private keys, tokens, or certificate passwords.

• Token acquisition uses Microsoft identity platform OAuth 2.0 client credentials flow.

• Access tokens are securely cached and refreshed as required.

Encrypted Email Support — Optional Future Enhancement
If encrypted email processing is required, IBM may consider a separate optional enhancement to support S/MIME or encrypted message processing.

This optional enhancement could include:

• A Decryption option in the mail configuration.

• Upload or secure reference to a .pfx certificate file.

• Validation that the .pfx contains:

  • One private key

  • One public certificate

  • The complete certificate chain required for decryption

• A protected password field for accessing the private key.

• Recommended file size limit, such as 1 MB.

• Secure storage and masking of certificate passwords.

Because encrypted email handling may require additional processing outside standard Microsoft Graph message retrieval, this should be treated as a separate optional capability from the core Graph app-only authentication enhancement.

Business Justification
This enhancement is required to allow IBM Datacap customers to continue processing Office 365 email securely as Microsoft deprecates EWS and as enterprise security teams eliminate username/password-based application integrations.

Without this enhancement, customers may be unable to use Datacap for Office 365 email ingestion in environments where security policy prohibits direct mailbox credentials. This creates operational risk, compliance risk, and potential product adoption barriers for organizations modernizing their Microsoft 365 security posture.

Requested Outcome
IBM Datacap should provide a supported Microsoft Graph Office 365 email authentication method using Microsoft Entra ID app-only authentication with client secret and certificate-based credentials, with certificate-based authentication recommended for production enterprise deployments.