Microsoft Exchange Connectivity via OAUTH
Clari supports integration with Microsoft Exchange sources. This article describes the options for connecting email to Clari for analysis.
Email and Calendar Linking
Clari connects to your email and calendar sources and analyzes the items in the context of the opportunities owned by your sales reps, managers, and directors. Clari API Connectors utilize published APIs into mail systems (Microsoft Exchange) for establishing secure, authenticated connections. All connections use HTTPS TLS 1.2 protocols with the highest levels of cryptographic algorithms. Authentication is done via OAuth 2.0, ADFS, SSO, and more.
Exchange (or Office365) Connectivity
The integration between Exchange (or Office365) and Clari allows for the extraction of activity data from email and calendar data from your rep's Exchange accounts.
Exchange connections use Exchange Web Services (EWS) or Exchange Active Sync (EAS). Clari obtains the authentication token during the Exchange-account linking process, which then uses cloud components in Clari to validate the authentication challenge and enable Exchange activity analysis. Clari initiates data access using EWS and EAS to retrieve email and calendar items.
There 2 two options for connecting your Microsoft Exchange account to your Clari account: TeamLinking and Individual Linking.
Exchange TeamLinking
With TeamLinking, the Exchange admin connects a provisioned and configured account to Clari and then chooses which mailboxes to analyze. TeamLinking is the default option for connecting to email and calendar since it eliminates the need for each rep to understand Exchange configurations and manually connect their accounts.
Moreover, when the team’s login credentials are changed in their Exchange mail environment, their credentials in Clari expire, forcing them to re-link their Exchange accounts. With TeamLinking, their accounts do not need to be re-linked.
Through Microsoft Exchange and Office 365 admin, Exchange administrators specify which user emails and calendar entries Clari will analyze. This can cover individual sales reps, the entire sales organization, or any subgroup within sales. This new account has privileges to impersonate all users associated with the mailbox.
TeamLinking provides a comprehensive, valuable view of all your team's activities.
Exchange Individual Linking
In the Individual Linking option, every individual user (i.e., a sales rep) links their Exchange email account to their Clari account. Clari obtains the authentication token during the linking process. Clari stores the authentication token using SHA-256 encryption to validate and enable email analysis. If a client organization uses single-sign-on (SSO) authentication, Clari delegates the authentication to the identity provider.
Individual linking does not require a client’s IT team to enable users. It can be managed entirely by the client’s sales-team support staff. However, it can result in gaps in the data ingested by Clari due to lack of sales rep adoption, loss of connectivity due to password changes, etc.
TeamLinking is our default and best practice for connection.
OAuth-based authentication for Microsoft Exchange and Office 365
Clari supports Microsoft’s APIs for OAuth 2.0 for Office 365 and Exchange authentication. The benefits of OAuth-based authentication are:
- Exchange credentials do not need to be stored. Instead, an authentication token is used.
- Authentication tokens expire, which increases security.
- The application is registered and approved by Microsoft to use REST.
SSO integration is possible for organizations who use SSO and have enabled ADFS with OAuth.
Email retrieval happens via MS EWS (ewsSession to login to customer/user account). The request includes the OAuth 2.0 access Token, and Clari retrieves the MS First Class Properties and stores the necessary fields only.
Data-Processing Phase
During the data-processing phase, Clari connects and retrieves email and calendar data in 15-minute increments. All internal email and calendar items, or those items that have external domains not associated with Salesforce accounts, are dropped. Only the items relevant to the organization's opportunities are stored in Clari. All email and calendar items are stored in a secure, encrypted data store managed by Clari.
Regardless of whether the connection was made via individual linking or TeamLinking, email and calendar entries are processed similarly, as shown below.
Clari Indexer JVM
The Clari Indexer JVM component retrieves 6 months of past emails and 12 months of past calendar entries, and 2 months of future calendar entries for analysis. MongoDB stores this data, and it's specially provisioned for Exchange content. All content is encrypted with robust data-at-rest encryption technologies. Most data retrieval and processing are performed in the Clari Indexer JVM. It performs multiple tasks, namely:
- Retrieves email and calendar entries and stores them as documents in MongoDB
- Categorizes email and calendar into external and internal
- Aggregates data into weekly buckets
Steps to Configure OAuth Based Exchange Connectivity
The first step is authorizing the Clari connector in your Exchange/O365 environment. The Clari team will provide a URL that grants this permission.
If setting up OAuth for Exchange TeamLinking, the second step is to authenticate the desired mailboxes via impersonation. This is done via a second URL from the Clari team.
If setting up OAuth for Exchange Individual Linking, individual users will be redirected to the Microsoft UI, where they will provide their credentials and grant the necessary access to Clari.
References
- https://practical365.com/exchange-server/configure-hybrid-modern-authentication-for-exchange-server/
- https://docs.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help
