Exchange Online app registration (group email addresses)

In the Microsoft Entra admin center, go to Applications → App registrations → New registration. Name it realsmart-exo-app, choose Accounts in this organizational directory only (single tenant), leave the redirect URI blank, and select Register.

On the app's Overview page, copy the Application (client) ID. You'll paste it into Realsmart in Step 5.

Still in the app, open API permissions in the left menu.

1. Select + Add a permission.
2. Select the APIs my organization uses tab. This permission is not on the Microsoft Graph tab.
3. Search for Office 365 Exchange Online and select it.
4. Select Application permissions.
5. Tick Exchange.ManageAsApp and select Add permissions.

Then select Grant admin consent for your organisation, so the permission is actually switched on and not just requested.

The permission lets the app sign in to Exchange Online; this role lets it change group addresses once it has.

1. In the Microsoft Entra admin center, go to Identity → Roles & admins → Roles & admins.
2. Search for Exchange Recipient Administrator and select the role's name.
3. Select Add assignments.
4. Search for realsmart-exo-app, select it, and select Add.

A certificate comes as a pair of files:

• a .cer file — the public half, which you add to the app in Azure;
• a .pfx file — the private half, protected by a password, which you upload to Realsmart in Step 5.

A self-signed certificate is fine. On a Windows computer, open PowerShell and run the following. It asks you to choose a password for the .pfx and saves both files in the folder PowerShell is open in.

$cert = New-SelfSignedCertificate -Subject "CN=realsmart-exo-app" `
    -CertStoreLocation "Cert:\CurrentUser\My" `
    -KeyExportPolicy Exportable -KeySpec KeyExchange `
    -KeyAlgorithm RSA -KeyLength 2048 -HashAlgorithm SHA256 `
    -NotAfter (Get-Date).AddYears(2)

Export-Certificate -Cert $cert -FilePath ".\realsmart-exo-app.cer"

$password = Read-Host -AsSecureString -Prompt "Choose a password for the .pfx file"
Export-PfxCertificate -Cert $cert -FilePath ".\realsmart-exo-app.pfx" `
    -Password $password -CryptoAlgorithmOption AES256_SHA256

$cert.Thumbprint

If PowerShell says it can't find the -CryptoAlgorithmOption parameter (older versions of Windows), run the Export-PfxCertificate line again without it.

Then, back in the app in the Microsoft Entra admin center, go to Certificates & secrets → Certificates → Upload certificate, choose realsmart-exo-app.cer, and select Add. Azure shows the certificate's Thumbprint — the same value PowerShell printed. You'll check it against Realsmart in the next step.

Do not create a client secret for this app; Exchange Online can't use one.

With the school selected, go to Entra sync → Settings and open the Group email addresses section.

1. Switch on Set group email addresses on our domain.
2. Exchange Online app ID — paste the Application (client) ID from Step 1. It looks like 00000000-0000-0000-0000-000000000000.
3. Tenant domain — your tenant's original Microsoft domain, ending .onmicrosoft.com (for example yourschool.onmicrosoft.com). Find it in the Microsoft Entra admin center under Settings → Domain names. Don't put your own domain here.
4. Select Save settings.
5. Under Certificate and progress, choose realsmart-exo-app.pfx next to Certificate file (.pfx), type its password under Certificate password, and select Upload certificate. The upload saves straight away; you don't need to select Save settings for it. It's checked first: if the password is wrong, the file is the .cer instead of the .pfx, or the certificate has already expired, you're told why and nothing is saved (see If the upload is refused).
6. Check the Thumbprint shown matches the one in Azure (Certificates & secrets). If it doesn't, the certificate in Azure and the one uploaded here are different — upload the matching pair.

Keep the private key private. The .pfx file and its password only ever go into this upload. Never email them to anyone — including Realsmart — or leave them in a shared folder. Once uploaded, you can delete the .pfx from your computer; if you need to replace the certificate later, make a new one.

Running a trust on one Microsoft 365 tenant? You only need one Exchange Online app. In MAT overview, Entra settings → Group email addresses lets you tick the settings and Exchange Online certificate once and apply them to every school you choose — see Apply sync settings across the trust.