Configure CRES Secure Email Encryption Service Add-in Centralised Deployment Using Microsoft 365

Introduction

This document describes how to configure Cisco Email Encryption Service Add-in centralised deployment via Microsoft Office 365.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

• Cisco Secure Email Gateway
• Cisco Secure Email Encryption Service (formerly known as Cisco Registered Envelope Service)
• Microsoft O365 suites (Exchange, Entra ID, Outlook)

Components Used

The information in this document is based on these software and hardware versions:

• Cisco Email Encryption Add-in 10.0.0
• Microsoft Exchange Online
• Microsoft Entra ID (formerly known as Azure AD)
• Outlook for O365 (macOS, Windows)

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

The Cisco Secure Email Encryption Service add-in allows your end users to encrypt their messages directly from Microsoft Outlook with a single click. This add-in can be deployed on Microsoft Outlook (for Windows and macOS) and Outlook Web App.

Note: This document is ideal for all the end users who plan to use the add-in use Office 365/Microsoft 365 subscription and all the end users who plan to use the add-in are registered Cisco Secure Email Encryption Service users.

Best Practices for Deploying the Cisco Secure Email Encryption Service Add-In

• Test Phase - Deploy the add-in to a small set of end users within a department or function. Evaluate the results and, if successful, move to the next phase.
• Pilot Phase - Deploy the add-in to more end users from different departments and functions. Evaluate the results and, if successful, move to the next phase.

• Production Phase - Deploy the add-in to all users.

Configure

Cisco Secure Email Encryption Service Add-in application registration

1. Log in to Microsot 365 Admin Center as at least a Cloud Application Administrator (Microsoft 365 Admin Center).

2. In the left-hand menu, expand Admin Centers and click on  Identity.

2. Navigate to Identity > Applications > App registrations and select  New registration.

Note: If you have access to multiple tenants, use the Settings icon in the top menu to switch to the tenant in which you want to register the application from the Directories + Subscriptions menu.

3. Enter a display Name for the application, select accounts that can use the application and click on  Register .

4. After successful registration, navigate to the application to configure client secret under  Certificates & secrets. Choose the expiration according to organization regulatory compliance.

5. From Overview page of the registered application, copy the Application (client) ID and  Directory (tenant) ID. Copy the Client Secret  from Certificates & secrets generated using the previous step.

6. Navigate to the registered Email Encryption application and go to  API permissions. Click on  Add a permission  and select required Microsoft Graph Application Permissions:

• Mail.Read
• Mail.ReadWrite
• Mail.Send
• User.Read.All

7. Click on  Grant Admin Consent for <tenant-name>  to give the application access to permissions on behalf of the organisation.

Configure Domain and Add-in Settings on Cisco Secure Email Encryption (CRES) Admin Portal

1. Login to Cisco Secure Email Encryption Service (CRES) admin portal as an Account Administrator. (https://res.cisco.com/admin)

2. Navigate to  Accounts > Manage Accounts. Click on the account number assigned to your organization or the account on which you plan to configure Email Encryption Add-in.

3. Navigate to  Profiles, select the Name type as Domain and enter your email domain name under Values. Click on  Add Entries  and wait for 5 to 10 seconds. (do not refresh the browser page or navigate to a different page until it is added successfully).

Tip: Repeat the same steps to add other email domains that is going to use Email Encryption Service in your organisation.

Note: Contact Cisco Technical Assistance Centre to get the email domains added on CRES Admin Portal.

4. Click on Add-in Config tab.
Step 1: Enter the Tenant, Client ID and Secret obtained from Entra ID under Azure AD Details. Click on  Save Details . 

Step 2: Select the domain, encryption type and click on  Save Configuration . Use  Save Configuration  for All Domains to apply the same settings to all added domains.

Caution: Do not navigate to a different page without completing Step 1. and Step 2. together. If Step 2. is not completed concurrently, Azure AD details wont be saved.

Step 3: Click on  Download Manifest.

Upload Manifest File to Microsoft 365 to Deploy Email Encryption Service Add-in

1. Login in to Microsoft 365 Admin Center as an Administrator. (Microsoft 365 Admin Center).

2. Navigate to  Settings > Integrated apps and click on Add-ins.

3. Click on Deploy Add-in and choose  Upload custom apps. Select I have the manifest file (.xml) on this device and upload the file downloaded from Cisco Email Encryption Service admin portal from the previous step. Click on  Upload .

4. On the next step, assign users who need access to Cisco Secure Email Encryption Service. For a phased manner deployment, choose Specifc Users/groups and click  Deploy .

5. Once the Add-in is successfully deployed, it can take up to 12 hours to be displayed on end users' ribbons (Outlook client).

Verify

Use this section in order to confirm that your configuration works properly.

1. Launch Outlook for Office 365/Microsoft 365 or Outlook Web App, compose the message that you want to encrypt, and add at least one valid recipient to it.

Note: If the encryption type (set by the administrator) is Encrypt, ensure that you have completed your message and added valid recipients before proceeding to the next step. After Step 3., the message is encrypted and sent immediately.

2. Open/Click on the Cisco Secure Email Encryption Service add-in.

• On Outlook Web App, click the ellipsis icon (located near the Send and Discard buttons), and click  Cisco Secure Email Encryption Service .
• On Outlook for Windows or MacOS, click Encrypt from the Ribbon or Toolbar.
• If you are on Outlook for MacOS version 16.42 or later and using the New Outlook interface, click  Cisco Secure Email Encryption Service  from the Toolbar.

3. Enter your credentials and click  Sign in . (Only if the Encryption Type is Flag, click  Send).

Troubleshoot

There is currently no specific troubleshooting information available for this configuration.

Relation Information

• Cisco Secure Email Encryption Service Account Administrator User Guide
• Cisco Secure Email Encryption Service Add-in User Guide
• Microsoft Entra Application Registration Guide
• Cisco Technical Support & Downloads