Entra ID setup

Updated on 2026-08-13

The relay authenticates as an application, not as a user. There is no interactive login and no refresh token. You do all of this in your customer's own Microsoft 365 tenant, once per customer tenant.

1. Register an application. Entra admin centre → App registrations → New registration. Single tenant. No redirect URI is needed.
2. Create a client secret. Certificates & secrets → New client secret. Copy the value immediately; it is shown once. Note its expiry - delivery stops when it lapses.
3. Add application permissions under API permissions → Microsoft Graph → Application permissions:
   • Mail.Send
   • Mail.ReadWrite
4. Grant admin consent. Application permissions do nothing until an administrator consents.

Why Mail.ReadWrite is needed, and how to keep it narrow

Mail.Send alone is not enough. Any attachment large enough to need an upload session is sent by creating a draft first, and creating a draft requires Mail.ReadWrite. In practice that is most scans. The connection test uses the same mechanism.

Mail.ReadWrite granted tenant-wide means read and write access to every mailbox in that customer's tenant, which is not what you want. Restrict the application to the specific mailboxes it may touch:

• RBAC for Applications (current approach): create a management scope covering only the mailbox that is meant to send and assign the application a role within it.
• Application Access Policy (older, still supported): create a mail-enabled security group containing only that mailbox and apply a policy restricting the app to it.

Do this before granting consent if you can. An unrestricted Mail.ReadWrite is the single biggest configuration mistake you can make with this product.