Integrations · guide

Setting up Unity Connection single inbox with Microsoft 365

Verified 2026-09-30 · 62 sources · tier 2

For A Unity Connection administrator configuring voicemail integration with Microsoft 365..

Cisco defines Single Inbox as the synchronization of user messages between Unity Connection and supported mail servers 49. For a single inbox user, voice messages are first stored in Unity Connection and immediately replicated to the user's Exchange or Office 365 mailbox 53.

Before you start

Starting with Release 15SU4, Unity Connection integrates with Microsoft Office 365 using the Microsoft Graph API instead of Exchange Web Services 25. Unity Connection Release 15 supports only the OAuth2 web-based authentication mode for unified messaging with Office 365; Basic and NTLM modes are no longer supported 34. Both SMTP and HTML notification devices require a connection to an SMTP smart host 33. Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

What should a user be able to do with a voicemail from their Microsoft 365 mailbox?

Does this Unity Connection cluster already have an Office 365 unified messaging service that was built on Exchange Web Services?

May the Unity Connection application reach every mailbox in the tenant, or only the mailboxes of voicemail users?

Three questions. One permanent page you can send to your manager.

Step 1 Verify version requirements

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox

Do

Confirm that Unity Connection is running Release 15SU4 or later, because Microsoft Graph API is the only supported option for Unity Connection integration with Office 365 starting in 15SU4 26. Microsoft states that in October 2026 Exchange Web Services starts to be disabled globally for all Exchange Online organizations 17, and Exchange Web Services in Exchange Online is fully disabled in April 2027 18. FN74203 gives the fix for impersonation retirement as upgrading to 12.5(1)SU8 or later, or 14SU3 or later, and configuring unified messaging with OAuth 2.0 client credentials flow, but recommends upgrading to Release 15 22.

Verify

Suggested check: verify the running software version on the server administration page indicates Release 15SU4 or higher.

Rollback

Suggested rollback: no changes are made during this check.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached

Do

Notification devices require a connection to an SMTP smart host rather than the mailbox API 33.

Verify

Suggested check: confirm the system is operational.

Rollback

Suggested rollback: no changes are made during this check.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox

Do

Relay relies on an SMTP smart host configured under System Settings > SMTP Configuration > Smart Host rather than the mailbox API 44.

Verify

Suggested check: confirm the system is operational.

Rollback

Suggested rollback: no changes are made during this check.

Step 2 Register the application in Microsoft Entra ID

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox + No, this is a first-time setup

Do

Under Microsoft Entra ID > App registrations > New registration, register a new application and record the Application (Client) ID and Directory ID 8. Create a client secret under Certificates & secrets and copy its value immediately, because it cannot be retrieved later and a new client secret would have to be created 14. Assign the Microsoft Graph permissions Mail.ReadWrite and Mail.Send for the Mail feature 27, ensuring they are of type Application rather than Delegated 36. On the API permissions window, select Grant admin consent for the tenant 5. Repeat the registration steps for each unified messaging service or cluster, using a unique Application ID for each cluster as recommended by Cisco 7.

Verify

Suggested check: inspect the registered application permissions in the tenant portal to confirm required grants are in place with admin consent for Application type.

Rollback

Suggested rollback: remove the created app registration from the tenant portal.

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox + Yes, an Office 365 unified messaging service already exists and the cluster is being taken to 15SU4 or later

Do

Open the existing application registration in the Azure portal, add the Microsoft Graph permissions Mail.ReadWrite and Mail.Send 27 of type Application 36, and select Grant admin consent for the tenant 5. These permissions on the Azure portal must be updated before upgrading Unity Connection to 15SU4 from any previous release 37. In the earlier EWS task list used before 15SU4, the application had the full_access_as_app application permission 19.

Verify

Suggested check: check the API permissions list in the portal to verify that application permissions show admin consent granted.

Rollback

Suggested rollback: remove the newly added Graph application permissions from the existing registration.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached + No, this is a first-time setup

Do

Both SMTP and HTML notification devices require a connection to an SMTP smart host 33.

Verify

Suggested check: proceed to SMTP configuration.

Rollback

Suggested rollback: no changes to reverse.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached + Yes, an Office 365 unified messaging service already exists and the cluster is being taken to 15SU4 or later

Do

Both SMTP and HTML notification devices require a connection to an SMTP smart host 33.

Verify

Suggested check: proceed to SMTP configuration.

Rollback

Suggested rollback: no changes to reverse.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox + No, this is a first-time setup

Do

Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

Verify

Suggested check: proceed to SMTP configuration.

Rollback

Suggested rollback: no changes to reverse.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox + Yes, an Office 365 unified messaging service already exists and the cluster is being taken to 15SU4 or later

Do

Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

Verify

Suggested check: proceed to SMTP configuration.

Rollback

Suggested rollback: no changes to reverse.

Step 3 Configure mailbox access scope

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox + Every mailbox; no restriction is applied

Do

For the Graph API integration the registered application is given the Microsoft Graph permissions Mail.ReadWrite and Mail.Send for the Mail feature across mailboxes 27.

Verify

Suggested check: confirm the application maintains tenant-wide permission grants in the management portal.

Rollback

Suggested rollback: no changes to reverse.

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox + Only members of a named mail-enabled security group

Do

In Exchange Online PowerShell using an account with the OrganizationConfiguration role, create a mail-enabled security group and run New-ApplicationAccessPolicy -AppId <app id> -PolicyScopeGroupId <group> -AccessRight RestrictAccess -Description "..." to limit the application to specific mailboxes 4. Microsoft states that RBAC for Applications in Exchange Online replaces Application Access Policies 40, but Application Access Policies constrain only the permissions assigned in Microsoft Entra ID, and Microsoft says Entra permissions can only be constrained using Application Access Policies 2. Do not rely on scoped RBAC while leaving unscoped Entra grants in place, because permissions granted in Microsoft Entra ID and permissions assigned through Exchange Online RBAC for Applications combine as a union 41.

Verify

Suggested check: verify that an account outside the specified security group cannot be accessed while an account inside the group functions correctly.

Rollback

Suggested rollback: remove the application access policy using management shell commands.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached + Every mailbox; no restriction is applied

Do

Both SMTP and HTML notification devices require a connection to an SMTP smart host 33.

Verify

Suggested check: proceed to the next step.

Rollback

Suggested rollback: no changes to reverse.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached + Only members of a named mail-enabled security group

Do

Both SMTP and HTML notification devices require a connection to an SMTP smart host 33.

Verify

Suggested check: proceed to the next step.

Rollback

Suggested rollback: no changes to reverse.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox + Every mailbox; no restriction is applied

Do

Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

Verify

Suggested check: proceed to the next step.

Rollback

Suggested rollback: no changes to reverse.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox + Only members of a named mail-enabled security group

Do

Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

Verify

Suggested check: proceed to the next step.

Rollback

Suggested rollback: no changes to reverse.

Step 4 Configure DNS and upload certificates

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox + No, this is a first-time setup

Do

In the CLI, configure DNS with the commands set network dns and set network dns options, ensuring Unity Connection uses the same DNS environment in which Active Directory publishes its records 16. Obtain the root certificate presented by https://graph.microsoft.com 10. In Cisco Unified Operating System Administration under Security > Certificate Management > Upload Certificate, upload the Office 365 root certificate under the certificate name tomcat-trust 12.

Verify

Suggested check: verify in the Certificate Management list that the root certificate is listed under tomcat-trust.

Rollback

Suggested rollback: remove the uploaded certificate from the trust store if necessary.

Do

Upload the root certificate presented by https://graph.microsoft.com to tomcat-trust in Cisco Unified Operating System Administration 10 12. Cisco recommends uploading the certificate before the upgrade; if it is uploaded after the upgrade, the Connection Mailbox Sync service must be restarted 11.

Verify

Suggested check: confirm the certificate appears in the tomcat-trust list before initiating the upgrade.

Rollback

Suggested rollback: delete the certificate entry from the certificate management interface.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached + No, this is a first-time setup

Do

Both SMTP and HTML notification devices require a connection to an SMTP smart host 33.

Verify

Suggested check: proceed to transport configuration.

Rollback

Suggested rollback: no changes to reverse.

Do

Both SMTP and HTML notification devices require a connection to an SMTP smart host 33.

Verify

Suggested check: proceed to transport configuration.

Rollback

Suggested rollback: no changes to reverse.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox + No, this is a first-time setup

Do

Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

Verify

Suggested check: proceed to transport configuration.

Rollback

Suggested rollback: no changes to reverse.

Do

Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

Verify

Suggested check: proceed to transport configuration.

Rollback

Suggested rollback: no changes to reverse.

Step 5 Configure transport services

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox + No, this is a first-time setup

Do

In Cisco Unity Connection Administration, navigate to Unified Messaging > Unified Messaging Services > Add New 59. Unity Connection Release 15 supports only the OAuth2 web-based authentication mode for unified messaging with Office 365; Basic and NTLM modes are no longer supported 34. Enter the Application (Client) ID, Directory ID, and Client Secret, keeping the default AD Authentication Endpoint of https://login.microsoftonline.com and default Resource URI of https://graph.microsoft.com 60. Select the Validate Certificates for Exchange Servers check box 61.

Verify

On the Edit Unified Messaging Services page, select the Test button to validate service connectivity 57.

Rollback

Suggested rollback: delete the newly created unified messaging service from the administration interface.

Do

Upgrade Unity Connection to 15SU4 or later; on upgrade to 15SU4 the Resource URI of an existing Office 365 unified messaging service changes automatically from https://outlook.office365.com to https://graph.microsoft.com 9. After migrating from EWS to Graph during the upgrade to 15SU4 or later, allow the service up to 4 hours to reach full stability before reconfiguring settings 23.

Verify

Confirm on the Edit Unified Messaging Services page that the Resource URI displays https://graph.microsoft.com 9, and select the Test button to verify the connection 57.

Rollback

Suggested rollback: returning to prior releases re-enables EWS, but rolling back to legacy transport is unsupported.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached + No, this is a first-time setup

Do

In Cisco Unity Connection Administration under System Settings > SMTP Configuration > Smart Host, configure the SMTP smart host by entering its IP address or fully qualified domain name 50.

Verify

Suggested check: confirm the IP address or hostname is saved in the Smart Host configuration field.

Rollback

Suggested rollback: clear the Smart Host field and save the configuration.

Do

In Cisco Unity Connection Administration under System Settings > SMTP Configuration > Smart Host, configure the SMTP smart host by entering its IP address or fully qualified domain name 50.

Verify

Suggested check: confirm the IP address or hostname is saved in the Smart Host configuration field.

Rollback

Suggested rollback: clear the Smart Host field and save the configuration.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox + No, this is a first-time setup

Do

Configure the SMTP smart host in Cisco Unity Connection Administration under System Settings > SMTP Configuration > Smart Host with the server IP address or fully qualified domain name 50 44.

Verify

Suggested check: confirm the Smart Host entry is saved in SMTP Configuration.

Rollback

Suggested rollback: clear the Smart Host entry to remove the relay host.

Do

Configure the SMTP smart host in Cisco Unity Connection Administration under System Settings > SMTP Configuration > Smart Host with the server IP address or fully qualified domain name 50 44.

Verify

Suggested check: confirm the Smart Host entry is saved in SMTP Configuration.

Rollback

Suggested rollback: clear the Smart Host entry to remove the relay host.

Step 6 Configure Class of Service, message aging, and relay policies

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox

Do

On the users' Class of Service under Licensed Features, check the Allow Users to Access Voicemail Using an IMAP Client and/or Single Inbox check box 15. Configure message aging to permanently delete messages in the Unity Connection deleted items folder, because a voice message deleted in Outlook—including from the Outlook Deleted Items folder—is only moved to the deleted items folder in Unity Connection and is not permanently deleted there 635. Ensure the quota of each Exchange mailbox is increased by the size of the quota of the corresponding Unity Connection mailbox 38.

Verify

Suggested check: verify on the Class of Service page that the single inbox licensed feature check box remains checked after saving.

Rollback

Suggested rollback: uncheck Allow Users to Access Voicemail Using an IMAP Client and/or Single Inbox on the Class of Service.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached

Do

Unity Connection sends notification email either as plain text through SMTP notification devices or as HTML through HTML notification devices, and HTML notifications can be used only for new voice mail 30.

Verify

Suggested check: verify that notification preferences are correctly saved in the administration portal.

Rollback

Suggested rollback: restore previous notification settings.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox

Do

Determine whether secure voicemails should be relayed; Unity Connection sends a non-delivery receipt to the sender when it cannot relay a message because the message is marked private or secure, and relaying of secure messages is permitted only if Allow Relaying of Secure Messages is checked under System Settings > Advanced > Messaging 45.

Verify

Suggested check: verify the Allow Relaying of Secure Messages check box state under System Settings > Advanced > Messaging.

Rollback

Suggested rollback: restore the Allow Relaying of Secure Messages setting to its previous value.

Step 7 Provision user accounts

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox

Do

For each user, open Users > Users > the user > Edit > Unified Messaging Accounts > Add New, select the unified messaging service, and enter the user's Exchange email address 58. Ensure the user has an SMTP proxy address configured that matches that Exchange email address 52.

Verify

On the user's Edit Unified Messaging Account page, select the Test button and examine the Task Execution Results window to verify successful account synchronization 5758.

Rollback

Suggested rollback: remove the unified messaging account entry from the user's profile.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached

Do

From the Edit User Basics page, navigate to Edit > Notification Devices and configure an HTML notification device for the user 32.

Verify

Suggested check: verify that the HTML notification device is active and lists the recipient address.

Rollback

Suggested rollback: disable or remove the HTML notification device from the user's account.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox

Do

For each user or user template, navigate to Edit > Message Actions, set the voicemail action to Accept and Relay the Message, and enter the recipient address 423.

Verify

Suggested check: verify that the message action displays Accept and Relay the Message with the intended relay address.

Rollback

Suggested rollback: change the message action back to Accept the Message.

Step 8 Verify message delivery

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox

Do

In Cisco Unity Connection Serviceability under Tools > Service Management, verify that both the Connection Mailbox Sync service and the Unity Connection Jetty service show Started 48. For a single inbox user, voice messages are first stored in Unity Connection and immediately replicated to the user's Exchange or Office 365 mailbox 53.

Verify

Suggested check: confirm the voicemail arrives in the mailbox inbox, and verify that reading or deleting the message synchronizes between endpoints.

Rollback

Suggested rollback: delete test voice messages from both the phone mailbox and the email inbox.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached

Do

Unity Connection does not detect notification failure for SMTP devices 51.

Verify

Suggested check: check the recipient mailbox to confirm the HTML notification email arrived.

Rollback

Suggested rollback: delete test notification emails.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox

Do

The Accept and Relay the Message action saves a copy of the message in the local Unity Connection user mailbox and also relays a copy to another address 3.

Verify

Suggested check: verify that a copy of the message exists in the Unity Connection user mailbox and that a separate copy was delivered to the relay email address.

Rollback

Suggested rollback: delete the test voicemail copies from both mailboxes.

Step 9 Validate user client interactions

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox

Do

Enabling single inbox adds a Voice Outbox folder to the user's Outlook mailbox, and without ViewMail for Outlook installed, voicemails sent from Outlook are treated by Unity Connection as .wav file attachments 62. When secure voice messages are sent, they are stored only on the Unity Connection server; the Exchange or Office 365 mailbox receives a decoy message, and playing the secure message requires Microsoft Outlook with Cisco ViewMail for Microsoft Outlook 47.

Verify

Suggested check: send a test secure voicemail and confirm the user receives a decoy message in Outlook.

Rollback

Suggested rollback: delete test messages.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached

Do

Verify

Suggested check: verify user receipt of voicemail notices and confirm understanding of scope.

Rollback

Suggested rollback: no rollback required.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox

Do

When a message type is set to Relay the Message, users can no longer reach the relayed messages from the Unity Connection phone interface, Web Inbox or other Unity Connection clients 43.

Verify

Suggested check: confirm the user understands the difference between retaining local copies and pure message relay.

Rollback

Suggested rollback: no rollback required.

Step 10 Verify network latency and synchronization scaling

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox

Do

Cisco says round-trip latency between Unity Connection and the Office 365 server should not exceed 250 ms 31. The Connection Mailbox Sync service uses four connections by default; above 2,000 users or 80 ms round-trip latency the design guide formula sets connections = (single-inbox users * (latency in ms + 15)) / 50,000, with a maximum of 64 and never fewer than four 54.

Verify

Suggested check: verify round-trip network ping or HTTP latency to the cloud endpoint remains below the recommended threshold.

Rollback

Suggested rollback: restore default connection settings if connection scaling parameters were adjusted.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached

Do

Both SMTP and HTML notification devices require a connection to an SMTP smart host 33.

Verify

Suggested check: confirm notification emails are delivered without queue delays.

Rollback

Suggested rollback: no changes to reverse.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox

Do

Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host 44.

Verify

Suggested check: confirm relayed voice messages are delivered promptly.

Rollback

Suggested rollback: no changes to reverse.

Step 11 Troubleshoot synchronization failures

Single inbox: voicemail is synchronized both ways between Unity Connection and the mailbox

Do

Confirm that both Connection Mailbox Sync and Unity Connection Jetty services show Started under Tools > Service Management 48. Check that the user has the correct Exchange email address and an identical SMTP proxy address 52. Run Test on both the Edit Unified Messaging Services page and the Edit Unified Messaging Account page 57. To isolate a certificate problem, uncheck Validate Certificates for Exchange Servers to see whether single inbox then works 13. If synchronization remains stalled, select Reset on an affected user's unified messaging account, or Reset on the associated unified messaging service, to resynchronize 46. Be aware that changes to application permissions in Exchange Online RBAC for Applications are subject to a cache that lasts between 30 minutes and 2 hours depending on the app's recent usage 39.

Verify

Suggested check: verify that test messages synchronize after resolving certificate or configuration mismatches.

Rollback

Suggested rollback: re-enable Validate Certificates for Exchange Servers after testing.

Email notification only: Unity Connection emails a notice of each new voicemail, optionally with the recording attached

Do

Because Unity Connection does not detect notification failure for SMTP devices 51, verify outbound mail traffic directly on the SMTP smart host.

Verify

Suggested check: check smart host transmission logs for SMTP handshake failures or non-delivery records.

Rollback

Suggested rollback: no changes to reverse.

Relay a copy: Unity Connection keeps the voicemail and forwards an independent copy to the mailbox

Do

Verify that the SMTP smart host remains correctly configured under System Settings > SMTP Configuration > Smart Host 44. Confirm whether a missing message was marked private or secure, which causes Unity Connection to send a non-delivery receipt to the sender unless Allow Relaying of Secure Messages is checked 45.

Verify

Suggested check: review smart host mail delivery logs and check the sender's mailbox for non-delivery receipts.

Rollback

Suggested rollback: no changes to reverse.

Applicability

Applies to: Microsoft Exchange Online and Cisco Unity Connection. Deployments: on-premises and multi-tenant. Sources checked 2026-09-30. The move to Microsoft Graph applies only to Office 365; Unity Connection integration with Exchange 2016 and Exchange 2019 continues to use Exchange Web Services 20. Field Notice FN74203 lists Unity Connection 12.5(1) through 12.5(1)SU7 and 14 through 14SU2 as releases whose single inbox stops synchronizing with Exchange Online after February 2025, because Microsoft retired the Application Impersonation role 21.

What remains uncertain

Whether Unity Connection single-inbox deployments can omit the optional calendar and contact permissions when integrating exclusively with Microsoft Graph is not covered by the sources below.

The maximum supported user ceiling per unified messaging service when using Microsoft Graph API rather than legacy EWS is not covered by the sources below.

Procedures for rotating or renewing expired Microsoft Entra ID client secrets on an existing unified messaging service are not covered by the sources below.

Sources

1
Because Cisco's procedure grants the Graph permissions in Microsoft Entra ID and Microsoft says Entra-granted permissions can only be constrained by Application Access Policies, the Application Access Policy is the scoping mechanism consistent with Cisco's documented setup, even though Microsoft describes it as replaced.inferred
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List for restricting Application Permissions to mailboxes; read together with ms-learn-exo-application-rbac FAQ · Checked 2026-09-30
2
Application Access Policies constrain only the permissions assigned in Microsoft Entra ID, and Microsoft says Entra permissions can only be constrained using Application Access Policies.
Role Based Access Control for Applications in Exchange Online · FAQ > Why does my application still have access...; FAQ > How does RBAC for Applications work alongside Application Access Policies? · Checked 2026-09-30
3
The Accept and Relay the Message action saves a copy of the message in the local Unity Connection user mailbox and also relays a copy to another address.
System Administration Guide for Cisco Unity Connection Release 14 - User Settings · User Settings > Message Actions > Accept and Relay the Message · Checked 2026-09-30
4
Cisco's task list for restricting the application to specific mailboxes creates a mail-enabled security group and runs New-ApplicationAccessPolicy with -AppId, -PolicyScopeGroupId and -AccessRight RestrictAccess in Exchange Online PowerShell, which requires the OrganizationConfiguration role.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List for restricting Application Permissions to mailboxes > Steps 1-5 · Checked 2026-09-30
5
After adding the permissions, an administrator selects Grant admin consent for the tenant on the API permissions window.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Steps for Registering the Application on the Azure Portal > Step 6 · Checked 2026-09-30
6
Cisco advises configuring message aging to permanently delete messages in the Unity Connection deleted items folder when single inbox is used.
Design Guide for Cisco Unity Connection 15 - Single Inbox · Single Inbox > deleting messages / message aging paragraph · Checked 2026-09-30
7
The registration steps must be repeated for each unified messaging service or cluster, and Cisco recommends a unique Application ID for each cluster.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List (Graph API) > Steps for Registering the Application on the Azure Portal > Step 7 · Checked 2026-09-30
8
Registering a new application under Microsoft Entra ID > App registrations > New registration yields the Application (Client) ID and Directory ID that Unity Connection uses to configure unified messaging.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List for Configuring Unified Messaging with Office 365 (Graph API) > Steps for Registering the Application on the Azure Portal > Steps 1-3 · Checked 2026-09-30
9
On upgrade to 15SU4 the Resource URI of an existing Office 365 unified messaging service changes automatically from https://outlook.office365.com to https://graph.microsoft.com.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Unified Messaging with Office 365 > upgrade note · Checked 2026-09-30
10
For the Graph API integration the root certificate to upload is the one presented by https://graph.microsoft.com, whereas the EWS procedure used the one from https://outlook.office365.com/EWS/Exchange.ASMX.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Uploading certificates for Office 365 > Graph API procedure · Checked 2026-09-30
11
Cisco recommends uploading the certificate before the upgrade; if it is uploaded after the upgrade, the Connection Mailbox Sync service must be restarted.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Uploading certificates for Office 365 > Graph API procedure note · Checked 2026-09-30
12
The Office 365 root certificate is uploaded in Cisco Unified Operating System Administration under Security > Certificate Management > Upload Certificate with the certificate name tomcat-trust.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Uploading certificates for Office 365 > procedure steps 1-4 · Checked 2026-09-30
13
To isolate a certificate problem, the troubleshooting guide has the administrator uncheck Validate Certificates for Exchange Servers and see whether single inbox then works.
Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Unified Messaging · Troubleshooting Single Inbox Issues > certificate validation step · Checked 2026-09-30
14
The client secret is created under Certificates & secrets and its value must be copied at creation time; otherwise a new client secret has to be created.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Steps for Registering the Application on the Azure Portal > Step 4 · Checked 2026-09-30
15
Single inbox requires the class of service Licensed Features check box Allow Users to Access Voicemail Using an IMAP Client and/or Single Inbox.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Settings Configured on Unity Connection Users > Steps 1-2 · Checked 2026-09-30
16
The Office 365 task list has the administrator configure DNS with the CLI commands set network dns and set network dns options, and recommends that Unity Connection use the same DNS environment in which Active Directory publishes its records.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List (Graph API) > Steps for Configuring Unified Messaging with Office 365 on Cisco Unity Connection Admin page > Step 3 · Checked 2026-09-30
17
Microsoft states that in October 2026 Exchange Web Services starts to be disabled globally for all Exchange Online organizations.
Deprecation of Exchange Web Services in Exchange Online · EWS deprecation timeline > October 2026 · Checked 2026-09-30
18
Microsoft states that Exchange Web Services in Exchange Online is fully disabled in April 2027.
Deprecation of Exchange Web Services in Exchange Online · EWS deprecation timeline > April 2027 · Checked 2026-09-30
19
In the EWS task list used before 15SU4, the application is given the full_access_as_app application permission, and the guide says it must be the only permission assigned.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List for Configuring Unified Messaging with Office 365 (EWS) > Steps for Registering the Application on the Azure Portal > Step 5 and note · Checked 2026-09-30
20
The move to Microsoft Graph applies only to Office 365; Unity Connection integration with Exchange 2016 and Exchange 2019 continues to use Exchange Web Services.
Release Notes for Cisco Unity Connection Release 15 Service Update 4 · New and changed > Microsoft Graph API support for Unified Messaging with Office 365 · Checked 2026-09-30
21
Field Notice FN74203 lists Unity Connection 12.5(1) through 12.5(1)SU7 and 14 through 14SU2 as releases whose single inbox stops synchronizing with Exchange Online after February 2025, because Microsoft retired the Application Impersonation role.
Field Notice: FN74203 - Cisco Unity Connection Unified Messaging with Microsoft 365, Voicemail Stored in Cisco Unity Connection Will Not Sync with Exchange Online (Outlook) Email Inbox - Software Upgrade Recommended · Products Affected; Problem Description · Checked 2026-09-30
22
FN74203 gives the fix as upgrading to 12.5(1)SU8 or later, or 14SU3 or later, and configuring unified messaging with OAuth 2.0 client credentials flow; it recommends upgrading to Release 15.
Field Notice: FN74203 - Cisco Unity Connection Unified Messaging with Microsoft 365, Voicemail Stored in Cisco Unity Connection Will Not Sync with Exchange Online (Outlook) Email Inbox - Software Upgrade Recommended · Workaround/Solution · Checked 2026-09-30
23
After migrating from EWS to Graph during the upgrade to 15SU4 or later, the unified messaging service may need up to 4 hours to reach full stability.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List for Configuring Unified Messaging with Office 365 (Graph API) > migration note · Checked 2026-09-30
24
In 15SU4 and later, synchronization covers only the default Outlook folders Inbox, Junk Email and Deleted Items; a voice message moved to a user-created folder in Office 365 is treated as deleted from the source folder on Unity Connection.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Introduction to Unified Messaging · Introduction to Unified Messaging > note on Cisco Unity Connection 15SU4 and later folder scope · Checked 2026-09-30
25
Starting with Release 15SU4, Unity Connection integrates with Microsoft Office 365 using the Microsoft Graph API instead of Exchange Web Services.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Unified Messaging with Office 365 > opening statement · Checked 2026-09-30
26
With Release 15SU4, Microsoft Graph API is the only supported option for Unity Connection integration with Office 365.
Release Notes for Cisco Unity Connection Release 15 Service Update 4 · New and changed > Microsoft Graph API support for Unified Messaging with Office 365 · Checked 2026-09-30
27
For the Graph API integration the registered application is given the Microsoft Graph permissions Mail.ReadWrite and Mail.Send for the Mail feature.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List (Graph API) > Steps for Registering the Application on the Azure Portal > Step 5 permissions table · Checked 2026-09-30
28
The same permissions table maps the Calendars feature to Calendars.ReadWrite and the Contacts feature to Contacts.ReadWrite.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List (Graph API) > Steps for Registering the Application on the Azure Portal > Step 5 permissions table · Checked 2026-09-30
29
An HTML notification can carry the voice message as an attachment when Allow voice mail as attachments to HTML notifications is enabled, up to a configurable maximum size that defaults to 2048 KB; secure and private voice messages cannot be sent as an attachment.
System Administration Guide for Cisco Unity Connection Release 15 - Notifications · Notifications > voice message as attachment to HTML notifications · Checked 2026-09-30
30
Unity Connection sends notification email either as plain text through SMTP notification devices or as HTML through HTML notification devices, and HTML notifications can be used only for new voice mail.
System Administration Guide for Cisco Unity Connection Release 15 - Notifications · Notifications > SMTP message notification · Checked 2026-09-30
31
Cisco says round-trip latency between Unity Connection and the Office 365 server should not exceed 250 ms.
Design Guide for Cisco Unity Connection 15 - Single Inbox · Single Inbox > Office 365 latency statement · Checked 2026-09-30
32
A user's notification devices, including SMTP and HTML devices, are configured from the Edit User Basics page under Edit > Notification Devices.
System Administration Guide for Cisco Unity Connection Release 15 - Notifications · Notifications > configuring notification devices > steps · Checked 2026-09-30
33
Both SMTP and HTML notification devices require a connection to an SMTP smart host.
System Administration Guide for Cisco Unity Connection Release 15 - Notifications · Notifications > SMTP message notification · Checked 2026-09-30
34
Unity Connection Release 15 supports only the OAuth2 web-based authentication mode for unified messaging with Office 365; Basic and NTLM modes are no longer supported.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List for Configuring Unified Messaging with Office 365 > authentication mode step · Checked 2026-09-30
35
A voice message deleted in Outlook, including from the Outlook Deleted Items folder, is only moved to the deleted items folder in Unity Connection and is not permanently deleted there.
Design Guide for Cisco Unity Connection 15 - Single Inbox · Single Inbox > deleting messages note · Checked 2026-09-30
36
The Microsoft Graph permissions for Unity Connection must be of type Application, not Delegated.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List (Graph API) > Steps for Registering the Application on the Azure Portal > Step 5 note · Checked 2026-09-30
37
The permissions on the Azure portal must be updated before upgrading Unity Connection to 15SU4 from any previous release.
Release Notes for Cisco Unity Connection Release 15 Service Update 4 · New and changed > Microsoft Graph API support for Unified Messaging with Office 365 · Checked 2026-09-30
38
Cisco says the quota of each Exchange mailbox should be increased by the size of the quota of the corresponding Unity Connection mailbox when single inbox is configured.
Design Guide for Cisco Unity Connection 15 - Single Inbox · Single Inbox > mailbox-size quotas paragraph · Checked 2026-09-30
39
Changes to application permissions in Exchange Online RBAC for Applications are subject to a cache that lasts between 30 minutes and 2 hours depending on the app's recent usage.
Role Based Access Control for Applications in Exchange Online · Limitations > cache maintenance bullet · Checked 2026-09-30
40
Microsoft states that RBAC for Applications in Exchange Online replaces Application Access Policies.
Role Based Access Control for Applications in Exchange Online · Overview; FAQ > How does RBAC for Applications work alongside Application Access Policies? · Checked 2026-09-30
41
Permissions granted in Microsoft Entra ID and permissions assigned through Exchange Online RBAC for Applications combine as a union, so an unscoped Entra grant left in place defeats a resource-scoped RBAC grant of the same permission.
Role Based Access Control for Applications in Exchange Online · FAQ > Why does my application still have access to mailboxes that aren't granted by the scope I used... · Checked 2026-09-30
42
The message action and its relay address are set per user or user template from the Edit menu > Message Actions.
System Administration Guide for Cisco Unity Connection Release 15 - Messaging · Messaging > Message Actions · Checked 2026-09-30
43
When a message type is set to Relay the Message, users can no longer reach the relayed messages from the Unity Connection phone interface, Web Inbox or other Unity Connection clients.
System Administration Guide for Cisco Unity Connection Release 14 - User Settings · User Settings > Message Actions > Relay the Message · Checked 2026-09-30
44
Unity Connection supports the relay function in a message action only when an SMTP smart host is configured on System Settings > SMTP Configuration > Smart Host.
System Administration Guide for Cisco Unity Connection Release 14 - User Settings · User Settings > Message Actions > smart host requirement · Checked 2026-09-30
45
Unity Connection sends a non-delivery receipt to the sender when it cannot relay a message because the message is marked private or secure; relaying of secure messages is permitted only if Allow Relaying of Secure Messages is checked under System Settings > Advanced > Messaging.
System Administration Guide for Cisco Unity Connection Release 15 - Messaging · Messaging > relaying secure messages · Checked 2026-09-30
46
The troubleshooting guide directs selecting Reset on an affected user's unified messaging account, or Reset on the associated unified messaging service, to resynchronize.
Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Unified Messaging · Troubleshooting Single Inbox Issues > Reset steps · Checked 2026-09-30
47
Secure voice messages are stored only on the Unity Connection server; the Exchange or Office 365 mailbox receives a decoy message, and playing the secure message requires Microsoft Outlook with Cisco ViewMail for Microsoft Outlook.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Introduction to Unified Messaging · Introduction to Unified Messaging > secure voicemail statements · Checked 2026-09-30
48
Single inbox synchronization depends on the Connection Mailbox Sync service and the Unity Connection Jetty service showing Started in Cisco Unity Connection Serviceability under Tools > Service Management.
Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Unified Messaging · Troubleshooting Single Inbox Issues > required services · Checked 2026-09-30
49
Cisco defines Single Inbox as the synchronization of user messages between Unity Connection and supported mail servers.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Introduction to Unified Messaging · Introduction to Unified Messaging > Single Inbox definition · Checked 2026-09-30
50
The SMTP smart host is set in Cisco Unity Connection Administration under System Settings > SMTP Configuration > Smart Host by entering the smart host's IP address or fully qualified domain name.
System Administration Guide for Cisco Unity Connection Release 15 - Notifications · Notifications > configuring the SMTP smart host · Checked 2026-09-30
51
Unity Connection does not detect notification failure for SMTP devices.
System Administration Guide for Cisco Unity Connection Release 15 - Notifications · Notifications > chaining message notification caution · Checked 2026-09-30
52
For single inbox to work, Unity Connection must be configured with the user's correct Exchange email address and the user needs an SMTP proxy address that matches that address.
Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Unified Messaging · Troubleshooting Single Inbox Issues > email address and SMTP proxy address checks · Checked 2026-09-30
53
For a single inbox user, voice messages are first stored in Unity Connection and immediately replicated to the user's Exchange or Office 365 mailbox.
Design Guide for Cisco Unity Connection 15 - Single Inbox · Single Inbox > Initial storage and replication paragraph · Checked 2026-09-30
54
The Connection Mailbox Sync service uses four connections by default; above 2,000 users or 80 ms round-trip latency the design guide's formula is connections = (single-inbox users * (latency in ms + 15)) / 50,000, with a maximum of 64 and never fewer than four.
Design Guide for Cisco Unity Connection 15 - Single Inbox · Single Inbox > calculating the number of connections · Checked 2026-09-30
55
Cisco tech note 118828 states that up to 1800 users can be configured with a single Office 365 unified messaging service.
Configure Unity Connection for Office 365 · Configure > Unity Connection > note on users per Unified Messaging Service · Checked 2026-09-30
56
Cisco tech note 118828, updated June 2025, still describes connecting Unity Connection to Office 365 with a service account that holds the ApplicationImpersonation role and whose credentials are entered on the unified messaging service, which conflicts with the Release 15 guide's statement that only OAuth2 is supported.disputed
Configure Unity Connection for Office 365 · Configure > Office 365 steps 4-8; Configure > Unity Connection > Account Used to Access Exchange · Checked 2026-09-30
57
A Test button is available on both the Edit Unified Messaging Services page and the Edit Unified Messaging Account page of a user.
Troubleshooting Guide for Cisco Unity Connection Release 15 - Troubleshooting Unified Messaging · Troubleshooting Single Inbox Issues > Test button paths · Checked 2026-09-30
58
A unified messaging account is added for a user from Users > Users > the user > Edit > Unified Messaging Accounts > Add New, and the Test button on that account opens a Task Execution Results window with the test results.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Creating Unified Messaging Accounts for Users > Steps 1-3 · Checked 2026-09-30
59
A unified messaging service is created in Cisco Unity Connection Administration under Unified Messaging > Unified Messaging Services > Add New.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Creating Unified Messaging Services in Unity Connection > Steps 1-3 · Checked 2026-09-30
60
The Office 365 unified messaging service takes the Application (Client) ID, Directory ID, Client Secret, an AD Authentication Endpoint whose default is https://login.microsoftonline.com, and a Resource URI whose default for Graph is https://graph.microsoft.com.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List (Graph API) > Steps for Configuring Unified Messaging with Office 365 on Cisco Unity Connection Admin page > Steps 1-2 · Checked 2026-09-30
61
Certificate validation for the Office 365 connection is turned on with the Validate Certificates for Exchange Servers check box in Unity Connection Administration.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Configuring Unified Messaging · Task List (Graph API) > Steps for Configuring Unified Messaging with Office 365 on Cisco Unity Connection Admin page > Step 4 · Checked 2026-09-30
62
Enabling single inbox adds a Voice Outbox folder to the user's Outlook mailbox, and without ViewMail for Outlook installed, voicemails sent from Outlook are treated by Unity Connection as .wav file attachments.
Unified Messaging Guide for Cisco Unity Connection Release 15 - Introduction to Unified Messaging · Introduction to Unified Messaging > Voice Outbox folder and ViewMail for Outlook statements · Checked 2026-09-30

Documents

tier 2 current vendor documentation

Field Notice: FN74203 - Cisco Unity Connection Unified Messaging with Microsoft 365, Voicemail Stored in Cisco Unity Connection Will Not Sync with Exchange Online (Outlook) Email Inbox - Software Upgrade Recommended

Cisco Systems · 2024-11-15 · accessed 2026-09-30

tier 2 current vendor documentation

Cite this page

APA

WarmTransfer. (2026, September 30). Setting up Unity Connection single inbox with Microsoft 365. WarmTransfer. https://warmtransfer.net/guides/unity-connection-single-inbox-setup

BibTeX

@misc{warmtransfer-unity-connection-single-inbox-setup,
  title  = {Setting up Unity Connection single inbox with Microsoft 365},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/unity-connection-single-inbox-setup},
  note   = {Verified 2026-09-30}
}