---
title: "Set up and Permissions for the Service Account"
slug: "set-up-and-permissions-for-the-service-account"
tags: ["On Prem Exchange", "Condtional Email Access"]
updated: 2024-07-19T10:06:23Z
published: 2024-07-19T10:06:23Z
canonical: "help.scalefusion.com/set-up-and-permissions-for-the-service-account"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.scalefusion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up and Permissions for the Service Account

### Objective

This document aims to identify the permissions required for a service account that can be used to authorize Scalefusion to provide [Conditional Exchange Access](/docs/conditional-email-access) for [Microsoft On-Prem Exchange](/docs/configure-cea-for-on-premise-exchange).

### Scope

The scope of this document is limited to identifying permissions for the service account that can be used to set up [Conditional Exchange Access](/docs/conditional-email-access) for Microsoft's [On-Prem Active Directory](/docs/configure-cea-for-on-premise-exchange). It does not cover how to set up CEA or other aspects of the entire feature. Please refer to our [Help documentation](/docs/conditional-email-access) for a complete understanding.

### Service Account & Required Permissions

For Scalefusion to provide Conditional Exchange access, it needs the credentials for an account that has permissions to,

1. Fetch all the devices where the end-user uses Email via Exchange protocol.
2. Fetch all the devices where the end-user uses Email via the Outlook application.
3. Set-Mailbox rules using Exchange Cmdlet that allows or blocks access to Mailbox using Device Identifiers.

To be able to perform above operations, a Global Administrator credentials can be used, however organizations that are required to create specific service accounts with scoped permissions can do so by following the steps below,

1. Create a new Service Account with a unique username and password
  1. You can also use an existing service account.
2. **Mail Recipient**: Grant this account the **Mail Recipient** permission![](https://lh7-us.googleusercontent.com/docsz/AD_4nXdEc8oGSNNULCbipGVITGVASYuh_uzT7X7dAdwkGkTGOLShb4868U-IyyjKPuC_3TjlVba5sLl4Qbj0RBgxQheNDqA_Erj0lrri6xqaktkli04OqzB95DQGs45ltzcJG3z-h8JFYdPSXP7LZ4OdikCoKjQ?key=yyiQeEsSPgoI6KrGUnRY7A)
3. **Organization Client Access:** Grant the Organization Client Access Permissions

![](https://lh7-us.googleusercontent.com/docsz/AD_4nXcGNQZwf98RVN4FxHHMseJ5jTwCpwF4Izwx0eV5S4JHqF3R5FrKmgeRXvIZzZ2M5EMN1lSV7sRNcMRoU-CzhpSmI-U-jwXeSHGxLwWAhgyJAmc1jaPn7x_K4C3in5arjmqkM-MUp2smMlX5oEs0d3wRsJLC?key=yyiQeEsSPgoI6KrGUnRY7A)