Yes, Power Automate is a good suggestion to look into. I only have a little experience with this but I think the logic makes sense.
When an email comes in that meets the condition, I can have a script to make an API call to create a SOAR ticket.
Original Message:
Sent: 9/9/2025 8:14:00 AM
From: Pierre Dufresne
Subject: RE: Inbound Email Connections with O365 mailbox
HI,
I don't know if this could be of any help but if you work in a Microsoft Windows based environment, you could use Power Automate to replace the SOAR inbox.
With Power Automate, you could trigger a Powershell or probably also a Python script when an email is received and meets certain condition like who the sender was or keywords in the subject.
You would have to adapt your current email script but that's one way you could it. I thnik :-)
HTH
------------------------------
Pierre Dufresne
------------------------------
Original Message:
Sent: Wed July 30, 2025 11:21 AM
From: Raymond Tam
Subject: Inbound Email Connections with O365 mailbox
Thanks for explaining the OAuth still needs to use the EWS API Endpoint. Good to hear that there is a plan to support MS-Graph.
In my current situation, it doesn't sound like the Inbound email is a feasible option. Hope the MS-Graph option will be available soon.
Meanwhile, I will look into other ways as a trigger for the SOAR incident creation.
If anyone in the forum has any creative ideas or workaround, please share.
Thanks,
Ray
Original Message:
Sent: 7/30/2025 4:01:00 AM
From: Martin Feeney
Subject: RE: Inbound Email Connections with O365 mailbox
I think the first thing to say is we use the EWS API for O365 regardless of the authentication protocol used.
We understand its due to be removed by Microsoft in October 2026 and will replace it with MS-Graph before then.
However if its already disabled in your env, then not sure what options we have.
As regards OAuth, have you reviewed the doc section here ? (We support both secrets and certs)
https://www.ibm.com/docs/en/sqsp/51.0.0?topic=administrator-changed-in-51020-configuring-inbound-email-connection
------------------------------
Martin Feeney
Product Manager, IBM Security QRadar SOAR
martin.feeney@ie.ibm.com
Original Message:
Sent: Tue July 29, 2025 05:42 PM
From: Raymond Tam
Subject: Inbound Email Connections with O365 mailbox
Has anyone successfully configured "Inbound Email Connections" using an O365 mailbox with any of the supported protocols?
If so, could you please share a sample configuration? I've reviewed all three protocol options, but not able to identify a suitable solution so far:
Exchange Protocol: This appears to use EWS, which is not enabled in our environment. Additionally, Microsoft is planning to retire EWS soon, so this doesn't seem like a viable long-term solution.
IMAP Protocol: IMAP is not allowed in our organization, so this option is not applicable.
OAuth Protocol: This seems like the most promising option, but I'm unclear how it works and which endpoint should be used for configuration.
------------------------------
Raymond Tam
------------------------------