Administration - Managing Connectors

This article contains information on configuring Mimecast connectors for cloud and on‑premises services, including setup steps, prerequisites, and considerations for multi‑tenant and hybrid environments.

Overview

This article contains information on configuring different types of connectors, which are required by certain Mimecast services, including:

• Continuity.
• Directory Synchronization (Microsoft Azure AD only).
• Mimecast Archive for Microsoft Teams.
• Mimecast Essentials for Outlook (MEO).
• O365 SimplyMigrate.
• Remediation.
• Sync & Recover.

This guide covers the following:

• Configuring connectors to cloud service providers.
• Configuring connectors to an on-premises Exchange server.
• Network and other considerations for EWS connectors.
• Editing and/or deleting connectors.
• Multi-tenancy considerations.
• Hybrid environment considerations.

Configuring a Connector to a Cloud Service Provider 

Mimecast connectors use OAuth 2.0 for authentication, providing greater security and allowing Administrators to apply the cybersecurity Principle of Least Privilege (PoLP) to their service accounts. A separate connector is required for each Mimecast product, replacing the previous practice of sharing a single connector across all Mimecast services. Each connector takes approximately five minutes to create.

Connectors for Microsoft Government Community Cloud (GCC) are not currently supported. Only Microsoft O365, Microsoft O365 GCC High (on USA and USB Mimecast grid accounts) and in some cases, Google Workspace.

When creating a Connector, the Provider subsection will note the available options.

Prerequisites

• The appropriate permissions to connect to your third-party provider.
• A Mimecast Administration Console role that provides access to the Services | Connectors page.
• Use Exchange Web Services with full access to all mailboxes permission has been granted, when prompted. This is needed, because the app needs full access via Exchange Web Services to all mailboxes.

Configuring a Cloud Connector

You can configure a Cloud connector by using the following steps:

1. Log in to the Mimecast Administration Console. 
2. Navigate to Integrations | Connectors.
3. Click on Create New Connector.
4. Select the Mimecast product you want to connect to a third-party provider and click on Next.
5. Select the third-party provider from the list and click on Next. 
6. Click on the login button to begin the OAuth 2.0 authorization process with the third-party provider.
7. Review and grant the requested permissions. 
8. Once the permissions have been successfully granted, click on Next.
9. Enter a connector Name and an optional Description, and click on Next.
10. Review the connector summary and click on Create Connector.

Configuring a Connector to On-Premise Exchange

Prerequisites and Network Considerations

• Exchange 2013 or later.
• A Mimecast Trusted SSL Certificate installed on your Exchange Client Access server(s).
• Exchange Web Services (EWS) must be accessible inbound using HTTPS on port 443 from the Mimecast IP range.
• Proxy Server Considerations: If you use a reverse proxy server (e.g., Microsoft's Threat Management Gateway) to publish your Exchange Client Access Server(s) to the internet, a direct connection from the Mimecast IP Range is required to the Exchange Web Services (EWS) URL, bypassing the standard forms-based authentication page that is typically presented.
• Application Impersonation permission is required for the Service Account. This is needed so that the app can act on behalf of users in your organization. See Application Impersonation role for more information.

If a forms-based authentication page is presented when a client connects to the EWS URL, Server Connections will fail as this configuration is not supported.

• Load Balancing Considerations: If you use load balancing, all connections to the Exchange Web Services (EWS) from the Mimecast IP range must be routed to the same Client Access Server. This is due to the challenge-response nature of the authentication process. For example, suppose the first request from the client is directed to one Client Access Server, and the second is directed to another. In that case, the second server receiving the challenge response token will not be aware of the first connection, resulting in the connection attempt failing.
• Using Exchange Server On-Premises and Exchange Web Services: If you're using an On-Premises Exchange server and Exchange Web Services (EWS), you must enable basic authentication.

Enabling Basic Authentication on a Client Access Server

You can enable basic authentication on a Client Access Server by using the following steps:

1. Open the Internet Information Services (IIS) Manager administrative tool on the Exchange Server hosting EWS 
2. Navigate to Server | Sites | Default Web Site | EWS 
3. Select the Authentication icon from the feature view 
4. Ensure that Basic Authentication is enabled. If not, enable it here 
5. Repeat this for all Exchange Servers in the organization 

If using UPNs with the account you're authorizing for the server connection, or the "Master Mailbox" accessing the other mailboxes through EWS; we recommend not using a local UPN. For example, if using [e-mail], ensure you're allowing the @emaildomain.user UPN. This may be already configured for Microsoft 365 access but may need configuration with On-Premises environments.

Configuring an Exchange Connector

You can configure an Exchange connector by using the following steps:

1. Log in to the Mimecast Administration Console. 
2. Navigate to Integrations | Connectors 
3. Click on the EWS Connectors tab.
4. Click on Create New Server Connection.
5. Enter a Server Connection Name for the server connection.
6. Complete the fields:

Field / Option	Description
Exchange Web Services URL	Specify the URL that Exchange uses to communicate with Exchange Web Services.
Security Mode	Select a security mode for the connection from the dropdown list. Strict is the default value.
Master Mailbox Address	Specify the email address and password of the master mailbox. If you've got a password policy to age passwords, either exempt the Master Mailbox from this policy or add a reminder to change the password configured in Mimecast.
Master Mailbox Password
Mailbox Check	Specify a known email address on your domain (e.g., [e-mail]) to verify authentication to your server connection. When you are ready, click on Test Connection. For Exchange Web Services, you must configure Application Impersonation to enable us to access your mailboxes. See Configuring Application Impersonation.

7. Click on Create Connection to create the new server connection.

Configuring a Google Workspace Connector

This is only applicable for Mimecast IEP Threat Remediation.

Prerequisites

• Administrative access to Google Workspace.
• Google Customer ID, which can be found on the Administrator panel in the Google account or via this link.
• For Google Workspace, the Threat Remediation Connector requires permissions
  for OAuth 2.0 scopes:
  https://mail.google.com, https://www.googleapis.com/auth/admin.directory.domain.readonly 
  This is needed because the app requires full access to all mailboxes for Remediation, and read-only access to list your Google Workspace domains so Mimecast can determine which domains this connector covers. See OAuth 2.0 Scopes for Google APIs for more information.
• Complete the Google Workspace setup in the section below, before creating or updating the connector.

Creating a Custom Administrator Role in Google Workspace

You can create a custom Administrator role in Google Workspace, by using the following steps:

1. Log in to the Google Admin Console.
2. Create a user (e.g. [e-mail]) that will be used to delegate domain listing calls from Remediation. See the Adding Users Individually page of the Google Workspace Administrator Help for full details.
3. Make a note of the User's Email Address. This is needed when creating or updating the Remediation Connector below.
4. Create a Custom Admin Role (e.g. Mimecast Remediation Role) with the privilege Domain Management. See the Creating Custom Administrator Roles page of the Google Workspace Administrator Help for full details.
5. Add the user created in Step 2 to the Role. See the Assigning Administrator Roles to a User page of the Google Workspace Administrator Help for full details.

Although Domain Management is not a read-only role, the Mimecast service will not be able to make any changes to your domains, as it will be limited by the https://www.googleapis.com/auth/admin.directory.domain.readonly permission.

Configuring a Google Workspace Connector

You can configure a Google Workspace connector, by using the following steps:

1. Log in to the Mimecast Administration Console. 
2. Navigate to Integrations | Connectors.
3. Click on Create Connector.
4. Select the Remediation option.
5. Click on Next.
6. Select the Google Workspace icon.
7. Click on Next.
8. Read the Configuration Guide on how to configure your Google Workspace account and click on Next.
9. Enter your Google Customer ID and the Mimecast Admin Account email address from Step 3 of the Google Workspace setup above.
10. Click on Next.
11. Your Mimecast Client ID and OAuth Scopes are displayed.
12. Navigate to Domain Wide Delegation in your Google Administration Console.
13. Create a new API client entry in the Domain Wide Delegation page.
14. Copy your Mimecast Client ID and OAuth Scopes from your Mimecast account into your new API Client on your Google account and authorize the access.

15. Navigate back to the Mimecast Administration Console and click on Next.
16. Enter a connector Name and an optional Description 
17. Click on Next.
18. Review the connector summary and click on Create Connector.

The task is now complete, and the new connector will be visible in the Connectors tab.

Deleting a Connector

A connector can only be deleted if it is not used by a Mimecast service. If you attempt to delete a connector that is in use by a Mimecast service, a notification is displayed informing you that you can't. 

To Delete a Cloud Connector

You can delete a cloud connector by using the following steps:

1. Click on the icon to the right of the connector to be deleted.
2. Click on the Delete button.
3. A confirmation pop-up appears.
4. To confirm the deletion of the connector, click on Delete.

If you want to remove the imported application from your Azure tenant or remove the domain wide delegation from your Google Workspace instance after you have deleted the associated connector from your Mimecast account, see  Mimecast Connectors - Applications imported via consent workflow.

To Delete an Exchange Web Services Connector

You can delete an Exchange Web Services connector by using the following steps:

1. Click on the icon to the right of the server connection to be deleted
2. Click on the Delete Connection button

Editing a Connector

Only the name and description of a connector can be edited. To adjust any other options, create a new connector with the relevant adjustments and delete the original connector. 

To Edit a Connector's Name and Description

You can edit a connector by using the following steps:

1. Click on the icon to the right of the connector to be edited.
2. Click on the Edit option
3. Enter the new Name or Description
4. Click on the Save button

Multi-tenancy Environments

If your organization's cloud-based email environment consists of multiple tenants, for example, to segregate data among multiple country jurisdictions, you will need to create one connector per Mimecast product per tenant.

An example would be an organization with three Microsoft 365 tenants protected by Mimecast's Sync & Recover. In this instance, three separate Sync & Recover connectors would be required, each configured to authorize a different Microsoft tenant. If the organization also uses Threat Remediation and Continuity, nine connectors would be required to connect all three tenants to all three Mimecast services. 

Hybrid Environments

You will need to set up connector(s) as required, depending on your environment:

Environment	Connectors required
Hybrid on-premises and cloud environments (where mailboxes are still on-premises)	One connector per Mimecast product for the cloud infrastructure, plus one Exchange server connector (that can still service all your Mimecast products).
Hybrid on-premises and cloud environments (where mailboxes are on the cloud)	Only one connector is required.
On-premises Exchange	Currently, only one connector is required.

See Also...

• Migrating Connectors
• Applications imported via Consent Workflow