IT Setup Guide

How sign-in works

Your staff sign in to DamageDocket with their existing Microsoft 365 work accounts. There are no new passwords, no separate directory, nothing to register in your own tenant for sign-in, and no consent to grant for it. DamageDocket issues each user a guest identity in our directory that points back at their real account in yours, so authentication always happens against your tenant, under your policies.

Your tenant is involved in two unrelated ways, and it helps to keep them separate as you work through this:

1. Permitting your users to sign in to an external organization (Part 1) — a cross-tenant setting.
2. Consenting to DamageDocket accessing your mailboxes and calendars (Part 2) — the only consent in this guide, and it has nothing to do with sign-in.

These are different things for different purposes. Completing one does not complete the other.

Before you begin

Have these DamageDocket production details ready:

You will need people who hold:

• Global Administrator in your tenant — for the consent step and add-in deployment.
• Exchange Administrator — for the mailbox access restriction in Part 2b.
• Authority to change web proxy / firewall policy, if your firm filters outbound traffic.

You will also need to decide, before Part 2, which shared mailbox DamageDocket should send from.

Part 1 — Allow staff to sign in

1.1 Confirm guest access to external organizations is permitted

In the Microsoft Entra admin center: External Identities → Cross-tenant access settings → Default settings → Outbound access.

Confirm that B2B collaboration is Allowed. This is the Microsoft default; if it has not been changed in your tenant, there is nothing to do here.

If your firm has restricted outbound access, add DamageDocket's directory as an exception under Organizational settings using the tenant ID we provided, and allow outbound B2B collaboration for it.

1.2 Send staff the application address

DamageDocket does not send an invitation email. Microsoft's standard guest-invitation message arrives from an unfamiliar organization and is subject to your mail filtering, so we suppress it deliberately and rely on you to distribute the address.

Users simply browse to the application address and sign in with their work account. Nothing else is needed in your tenant. Each person must first have been added as staff in DamageDocket by your firm's DamageDocket administrator — that, and not any tenant setting, is what gives them access.

Part 2 — Connect mailboxes and calendars

DamageDocket integrates with Microsoft 365 mail and calendars. One consent grant, given once by a Global Administrator, covers all of it. That grant is not for sign-in — sign-in needs no consent in your tenant at all.

Choose or create the shared mailbox DamageDocket will send from. You need its address in 2b and again in 2c. Imported hearings will also appear on this mailbox's calendar.

Set up the shared mailbox and hearing calendar

1. If you do not already have a suitable shared mailbox, sign in to the Microsoft 365 admin center with Exchange administrator access. Go to Teams & groups → Shared mailboxes → Add a shared mailbox, enter a recognizable name and address, then save it. Allow a few minutes for the mailbox to be created. If your Microsoft 365 provider manages admin access, use its shared-mailbox setup instead or ask the provider to create the mailbox.
2. Open the mailbox and add staff who need access to both its mail and hearing calendaras members. Membership gives them access to both, so limit it to the people who need both. For staff who only need to see hearings, grant Reviewer permission on the mailbox's Calendar folder instead of making them mailbox members. Add future staff as needed.
3. Ask one member to open the shared mailbox's calendar in Outlook and confirm it is visible. In new Outlook, they can add the mailbox under Shared with me if it does not appear automatically. This calendar is where DamageDocket places imported hearings and court events.

See Microsoft's shared mailbox setup instructions for mailbox creation and membership, and its calendar-folder permission reference for calendar-only access. Staff access is separate from the DamageDocket consent and mailbox restriction in 2a–2b.

2a — Grant DamageDocket access to Microsoft 365

Open the DamageDocket administrator consent page below. It explains the grant and the safety checks to make before its button takes you to Microsoft's consent screen.

The address does not name your tenant: signing in is what tells Microsoft which directory the grant applies to, which is why the same page works for every firm.

Permissions requested: Mail.ReadWrite, Mail.Send, Calendars.ReadWrite, and offline_access so the connection stays live. Each of the first three appears twice on the consent screen — once for access on behalf of a signed-in user, which covers individual staff mailboxes, and once for access with no signed-in user, which is the only way a shared mailbox can be reached. That is one grant, not two.

The screen will say the application is unverified. DamageDocket is not a Microsoft-verified publisher, so Microsoft shows "This application is not published by Microsoft or your organization." This is expected on this link. Before accepting, confirm the screen names the application DamageDocket-GraphConnector-Prod — that, rather than the publisher notice, is what tells you the link took you to the right place.

When you accept, Microsoft records the grant and returns you to a DamageDocket confirmation page showing your directory (tenant) ID. Note that ID down — you hand it back in 2c. Reading that page needs no DamageDocket account.

What this enables for each member of staff:

• Emails are linked to cases automatically, and appear in the case file for the whole team.
• The Outlook add-in can link and attach from the message a user is reading or composing.
• DamageDocket appointments sync to each user's own Outlook calendar.
• The connection stays live without repeatedly asking the user to sign in again.

Granting it here matters most where your tenant restricts user consent for mailbox permissions. Where it does, and this grant has not been given, each staff member is instead blocked individually with "Need admin approval" the first time they try to connect their mailbox.

What this enables for the firm's shared mailbox. The same grant is what lets DamageDocket use the shared mailbox you chose. This is not optional convenience — four capabilities depend on it entirely:

2b — Restrict access to just that mailbox

In Exchange Online PowerShell:

Connect-ExchangeOnline

New-DistributionGroup -Name "DamageDocket Mailboxes" -Alias dd-mailboxes `
  -Type Security -Members cases@yourfirm.com

New-ApplicationAccessPolicy -AppId 55f91a86-a916-4498-acf5-da3203ced9ee `
  -PolicyScopeGroupId dd-mailboxes@yourfirm.com `
  -AccessRight RestrictAccess -Description "Limit DamageDocket to the case mailbox"

# Confirm the restriction works — this should report Denied
Test-ApplicationAccessPolicy -Identity partner@yourfirm.com -AppId 55f91a86-a916-4498-acf5-da3203ced9ee

55f91a86-a916-4498-acf5-da3203ced9ee is the production DamageDocket integration you just granted. The policy must name that same application in order to restrict it.

The restriction is not instant. Microsoft states an application access policy can take up to about 30 minutes to take effect, and Test-ApplicationAccessPolicy may report the old answer until it has. If the test above returns Granted immediately after you create the policy, wait and run it again before assuming anything is wrong.

If your firm already uses Microsoft's newer RBAC for Applications, that achieves the same result and can be used instead. It is configured the same way, in Exchange Online PowerShell — there is no screen for it, or for the policy above, anywhere in the Exchange admin center. This step has no portal equivalent.

2c — Send the details to your DamageDocket administrator

Send these two values to the person at your firm who administers DamageDocket:

They enter both under Firm Settings in DamageDocket, which completes the connection. DamageDocket verifies access to that specific mailbox before saving, so an incorrect address fails immediately with a clear reason rather than causing problems later.

This is the only step in this guide that needs someone with a DamageDocket account. Everything before it is yours alone.

A note on inbound traffic

Nothing in Part 2 requires opening your firewall or publishing an endpoint. Microsoft delivers mail notifications to DamageDocket's service directly; no traffic is initiated toward your network.

Part 3 — Deploy the two Office add-ins

Find both DamageDocket add-ins in the Microsoft Marketplace through the Microsoft 365 admin center. Search for the names below and confirm the publisher is DamageDocket.

Deployment steps — repeat for each add-in

1. Sign in to admin.microsoft.com as a Global Administrator.
2. Go to Settings → Integrated apps, then select Get apps to open the marketplace.
3. Search for DamageDocket Templates. Select the Word add-in published by DamageDocket, then select Get it now.
4. Follow the deployment wizard and choose who gets it. Select Specific users or groupsand target your DamageDocket user group to keep add-in visibility aligned with who is licensed.

   

5. Review and accept the requested permissions, then select Finish deployment. Select Done when deployment completes.
6. Repeat steps 2–5, this time searching for DamageDocket Mail Sync and selecting the Outlook add-in published by DamageDocket.

With centralized deployment, confirm DamageDocket Templates and DamageDocket Mail Sync appear in the Deployed apps list and are assigned to the intended users or groups. With individual installation, have each user confirm both add-ins appear in Word and new Outlook.

A newly deployed add-in is not available immediately — Microsoft advises allowing up to 72 hours for it to appear on the ribbon. Users should fully close and reopen Office to pick it up. The Word add-in appears on the Home ribbon; the Outlook add-in appears on both the reading and composing ribbons.

See Microsoft's Office add-in deployment guidance for rollout and availability details.

Client requirements

Piloting first

Pilot with a small group. For centralized deployment, follow the steps above and at step 4 select Specific users or groups. Widen access afterwards by changing each add-in's assignment. If centralized deployment is unavailable, ask just the pilot users to install both add-ins from Microsoft Marketplace first.

If you plan to run a pilot or test environment alongside production, tell DamageDocket first — the two sets of add-ins need to be issued so that they can coexist in one tenant.

Part 4 — Network and web filtering

Allow outbound HTTPS to:

Good to know

• No SPF, DKIM, or DMARC changes are needed. DamageDocket sends through your own Microsoft 365 mailbox, so mail leaves as your firm and is already aligned with your existing records.
• DamageDocket does not send system email. There are no invitation emails, no expiry or billing notices, and no password emails — there are no passwords. Notifications appear inside the application. Plan any account or billing communication through your normal channels.
• Connecting a mailbox does not import past email. Linking begins from the moment a mailbox is connected; historical messages are not backfilled.
• Calendar entries created by DamageDocket carry a "DamageDocket" category and deliberately have no attendees, so Outlook never sends your staff meeting invitations they have to accept. Mention this to users before they notice entries appearing.

If something does not work

Setup checklist

• Confirmed outbound guest access is permitted (1.1)
• Application address distributed to staff (1.2)
• Shared mailbox created or chosen, and hearing-calendar members added (2)
• Admin consent granted for mail and calendars (2a)
• Mailbox access restricted to that mailbox only (2b)
• Directory ID and shared mailbox address sent to your DamageDocket administrator (2c)
• Word add-in deployed or installed for each user (3)
• Outlook add-in deployed or installed for each user (3)
• Outlook add-in users use new Outlook or Outlook on the web (3)
• Outbound addresses and WebSocket traffic permitted (4)
• Pop-ups allowed for Outlook on the web, if used (3)