cloud-api account
Use this command to connect to Microsoft 365 and Google Workspace to scan email in the user mailboxes.
Before scanning email in Microsoft 365, Microsoft Exchange, or Google Workspace mailboxes, FortiMail uses OAuth to authenticate with the service API. So for each tenant ID, you must create the service account that FortiMail will use to authenticate. Grant read permissions required to scan the email, but also for related actions such as moving email to quarantine and sending notifications.
Syntax
config cloud-api account
edit <profile_name>
[set description "<comment_str>"]
set type {exchange | ms365 | gmail}
set application-secret <password_str>
set service-endpoint {china | germany | global | us-dod | us-gov}
set service-email <service_email>
set service-password <password_str>
set global-address-list <id_str>
set admin-email <administrator_email>
set realtime-scan-status {enable | disable}
config user-filter
edit <user-filter_index>
set type {ad-group | email-group | imported-user | ldap-group | regex | wildcard}
set ad-group-attr {custom | displayname | mail}
set ad-group-attr-name <attribute-name_str>
set ad-group-attr-value <attribute-value_str>
set ldap-profile <profile_name>
set pattern <user-filter_pattern>
next
end
end
|
Variable |
Description |
Default |
|
Enter a unique name for the profile. |
|
|
|
Enter an index number to identify the user filter. |
|
|
|
Enter the custom Microsoft Azure Entra ID (formerly Active Directory) group attribute name. This setting is only available if |
|
|
|
Enter the Microsoft Azure Entra ID (formerly Active Directory) group attribute value. This setting is available only if |
|
|
|
Select the type of group attribute name to use for a user filter with Microsoft Azure Entra ID (formerly Active Directory).Also configure This setting is available only if |
displayname |
|
|
Enter your organization's Google Workspace service account for FortiMail. This setting is available only if |
|
|
|
Enter your organization's Microsoft 365 application ID for FortiMail. This setting is available only if |
|
|
|
Enter your organization's Google Workspace administrator account JSON content that contains the application key. This setting is available only if |
|
|
|
Enter your organization's Microsoft 365 application secret for FortiMail. This setting is available only if |
|
|
|
Enter a description or comment. |
|
|
|
Select which email group to use for the user filter. This setting is available only if |
|
|
|
Enter the GUID of a global address list. To get the ID, start a Microsoft Exchange management shell and enter the command: Get-GlobalAddressList|fl name,guid This setting is available only if |
|
|
|
Enter the group name to use for the user filter. This setting is available only if |
|
|
|
Select which LDAP profile to use for the user filter. Also configure This setting is available only if |
|
|
|
Select which pattern to use for the user filter. This setting is available only if |
|
|
|
Enable or disable real-time scans for the account. Also configure |
enable |
|
|
Enter your organization's Microsoft Exchange service account for FortiMail This setting is available only if |
|
|
|
service-endpoint {china | germany | global | us-dod | us-gov} |
Select either This setting is available only if |
global |
|
Enter your organization's Microsoft Exchange service account password. This setting is available only if |
|
|
|
Enter your organization's Microsoft Exchange service URL. This setting is available only if |
|
|
|
Enable or disable the account used by the cloud API connector. |
enable |
|
|
Enable or disable this user filter. |
disable |
|
|
Enter your organization's Microsoft 365 tenant ID. This setting is available only if |
|
|
|
type {ad-group | email-group | imported-user | ldap-group | regex | wildcard} |
Select the user filter type, either:
|
wildcard |
|
Select whether the cloud API account for FortiMail is on Microsoft Exchange EWS, Microsoft 365, or Google Workspace (Gmail). Also configure account settings that vary by this type, such as |
ms365 |