Configure Exchange Online with the Owl for Exchange add-on in Thunderbird

• Overview
  • Add Owl for Exchange to Thunderbird
  • Add your Exchange Online account
  • Install your S/MIME certificate
  • Set up S/MIME encryption
• Secondary accounts
• Known issues and unknowns

Overview

To connect to Exchange Online at IU using Owl for Exchange in Thunderbird, follow these instructions. These steps have been tested on Windows, macOS, and Linux (specifically Debian) using Thunderbird 78.

Add Owl for Exchange to Thunderbird

To add and enable the Owl for Exchange add-on in Thunderbird:

1. In Thunderbird, click Tools, and then select Add-Ons.
2. In the search box, search for owl to find the Owl for Exchange add-on, and then click the corresponding Add to Thunderbird icon.
3. When prompted to add Owl for Exchange, click Add, and then click OK.

Add your Exchange Online account

To add your IU Exchange Online account:

1. Return to the Add-ons Manager tab, click Extensions, and find Owl for Exchange in the list of enabled extensions.
2. Click the corresponding More options icon ( ), and then select Options or Preferences.
3. Select Add new account manually, and then:
   • Your name: Enter your name as you would like it displayed.
   • Your email address: Enter your primary IU email address.
   • Your username: Enter username@iu.edu (replace username with your IU username).
   • Protocol: Select Outlook Web Access.
   • Login method: Select Open login web page.
   • Webmail page: Enter https://outlook.office.com/owa.
4. Click Create account.
5. When prompted, confirm your identity with Two-step Login (Duo).

Install your S/MIME certificate

To install your S/MIME certificate:

1. In Thunderbird for Windows, click Tools, and then select Options. In Thunderbird for Linux, click Edit, and then select Preferences. In Thunderbird for macOS, click Preferences.
2. Click Privacy & Security.
3. Scroll to the bottom, and then click Manage Certificates.
4. Click Your Certificates, and then select Import.
5. Locate and select your S/MIME certificate, and then click Open.
6. Enter the password to install your certificate, and then click OK twice.

Set up S/MIME encryption

To set up your S/MIME certificate for use with your account:

1. In Thunderbird for Windows or macOS, click Tools, and then select Account Settings. In Thunderbird for Linux, click Edit, and then select Account Settings.
2. At the bottom right, click Manage Identities.
3. Select your account, and then click Edit.
4. Click End-To-End Encryption, and then, under "S/MIME" (beside "Personal certificate for digital signing", click Select.
5. If your imported S/MIME certificate is not already selected, select it from the drop-down at the top, and then click OK.
6. When you see the following prompt, click Yes:

   You should also specify a certificate for other people to use when they send you encrypted messages. Do you want to use the same certificate to encrypt & decrypt messages sent to you?

7. Under "Default settings for sending messages", select Do not enable encryption by default and Add my digital signature by default.
8. Click OK, then Close, and then close Account Settings.

Secondary accounts

It is not possible to directly add secondary IU Exchange Online accounts (for example, group accounts) with Owl using their credentials. This will generate a "You already have an OWA account with this hostname" error. However, "Full Access" and "Send As" rights, as well as delegate access, will work using the Owl for Exchange add-on.

• If a secondary account is added as an additional account via OWA (so that it appears in the Folder menu when you are logged into OWA via your IU Exchange Online account, as described in Add the shared mailbox so it displays under your primary mailbox), it also will appear in Thunderbird in the Folder menu when you are logged into Exchange Online with Owl. "Full Access" rights and delegate access can be used to grant the ability to view a secondary account in this manner.
• "Send As" rights will work when sending a message. To change the sender address, in the new message window, click the From field, and then select Customize From Address, and then enter the email address for which you have "Send As" rights.
• Delegate access also can be used to send messages "on behalf of" others, using the same method described above. The only difference is that "Send As" rights will make messages appear as if they were sent directly from the secondary account, whereas delegate access will show messages as being sent "on behalf of" the secondary account.

Known issues and unknowns

• Shared calendar access is not supported.
• S/MIME for secondary accounts is not supported. If you send from a secondary account using FASA or delegate access, and the message editor is set to digitally sign the message, it will attach the S/MIME certificate for your primary email account.