Microsoft 365 Email Configuration | Axero Documentation

This guide outlines the steps to configure Axero to send emails using a Microsoft 365 account via the secure Microsoft Graph API with OAuth 2.0 authentication. This method is preferred over legacy SMTP basic authentication.

1. Confirm prerequisites

Ensure the following prerequisites are met:

1. Microsoft 365 License

   • Required License: Microsoft 365 Business Standard or higher with Exchange Online Plan 1 or Plan 2

   • Shared mailboxes cannot be used unless they are converted to licensed accounts

2. Administrative Access: You will need the following roles:

   • Microsoft Entra ID: Global Administrator or Application Administrator to register the application and grant API permissions (https://entra.microsoft.com)

   • Microsoft Exchange Online: Exchange Administrator to manage tenant-wide SMTP settings (https://admin.exchange.microsoft.com)

   • Microsoft 365 Admin Center: User Administrator or Global Administrator to manage user-specific SMTP settings (https://admin.microsoft.com)

   • Axero: Site Administrator to configure email settings within your Axero platform

2. Register a new app in Microsoft Entra ID

1. Sign in to the Microsoft Entra portal at https://entra.microsoft.com with a Global Admin or Application Admin account.

2. In the left navigation, select Entra ID > App registrations, then click New registration.

   

3. Enter a descriptive name for the app (e.g., "Axero Email Integration").

   

4. Set Supported account types to Accounts in this organizational directory only (single tenant).

5. Click Register.

6. After registration, record the following values (you'll need them later):

   • Directory (tenant) ID
   • Application (client) ID

   

✅ Validation checkpoint: Confirm you have successfully recorded both the Directory (tenant) ID and Application (client) ID before proceeding.

3. Configure a redirect URI

1. In the registered app, click Authentication.

2. Click Add Redirect URI, and then Web.

   

3. Under Redirect URI, enter https://YOUR_AXERO_URL/oauth2/sharepoint/callback

   • Replace YOUR_AXERO_URL with your Axero site address.

4. Click Configure.

✅ Validation checkpoint: Verify the redirect URI is correctly formatted with your actual Axero URL.

4. Create a client secret

1. In the registered app, open Certificates & secrets and click New client secret.

   

2. Provide a descriptive description (e.g., "Axero Email Secret") and choose an expiry period.

   • 💡 Recommended: 12-24 months for production environments
   • ⚠️ Important: Set a calendar reminder 30 days before expiry to avoid service disruption

3. Click Add.

   

4. Copy the Value of the newly created client secret. This value is shown only once. Store it securely alongside the Client ID and Tenant ID obtained in Step 2.

   

✅ Validation checkpoint: Confirm you have securely stored all three values: Tenant ID, Client ID, and Client Secret.

5. Assign API permissions

1. In the registered app, open API permissions.

2. Click Add a permission and select Microsoft Graph.

   

3. Choose Delegated permissions. Axero will send email as the configured user, requiring delegated access.

   

4. Search for Mail.Send and select it. This scope allows Axero to send emails on behalf of the configured user.

5. Search for offline_access and select it. This scope enables automatic token refresh without requiring user re-authentication.

6. Click Add permissions.

✅ Validation checkpoint: Confirm the required permissions (Mail.Send and offline_access) are listed in your API permissions.

6. Enable SMTP AUTH at the Tenant Level

Even though you are using the modern Graph API method, Microsoft requires the underlying SMTP AUTH protocol to be enabled for the mailbox being used.

1. Go to the Exchange admin center: https://admin.exchange.microsoft.com.

2. Sign in with an Exchange Administrator account.

3. Go to Settings > Mail flow.

4. Ensure Turn off SMTP AUTH protocol for your organization is unchecked (disabled).

   

5. Click Save.

✅ Validation checkpoint: Confirm that SMTP AUTH is enabled at the tenant level before proceeding to user-specific settings.

7. Enable SMTP AUTH for the Sending User Account

1. Go to the Microsoft 365 admin center: https://admin.microsoft.com.

2. Sign in with appropriate admin credentials (User Admin, Global Admin).

3. Go to Users > Active users.

   

4. Find and click on the specific licensed user account that will be used to send emails from Axero.

5. In the user's details pane that opens, select the Mail tab.

6. Click on the Manage email apps link.

7. Ensure the Authenticated SMTP option is checked (enabled).

   

8. Click Save changes.

✅ Validation checkpoint: Verify that SMTP AUTH is enabled for the specific user account that will send emails from Axero.

8. Configure email settings in Axero

1. Open a new browser window and sign in to your Axero site as a Site Administrator.

2. Go to Control Panel > System > General Settings > Email Settings.

3. Under SMTP server, enable Office 365.

   

4. Click Settings and enter the following configuration:

   

   Setting	Value	Description
   From Email Address	notifications@yourcompany.com	The licensed Microsoft 365 user mailbox for sending emails
   Tenant ID	Directory (tenant) ID from Step 2	Your Microsoft Entra ID tenant identifier
   App Client ID	Application (client) ID from Step 2	Your registered application identifier
   App Client Secret	Client secret value from Step 4	Your application's authentication secret

5. Click Save Settings.

6. Click Connect. You will be redirected to the Microsoft sign-in page.

   • ⚠️ Critical: Log out of any Microsoft admin accounts first, then sign in as the user who owns the licensed mailbox specified in the "From Email Address" field.

   • ✅ When prompted, accept the requested permissions to complete the authorization.

7. Upon successful authorization, scroll down and click Save System Settings.

✅ Validation checkpoint: Verify that the connection was successful and no error messages are displayed in Axero.

9. Test email sending

1. In Axero, go to People > Manage People.

2. Select Send Email or Options > Mass Email.

   

3. Select a test recipient (preferably yourself) and compose a test message with a clear subject line (e.g., "Axero Email Test - [Current Date]").

4. Send the email and verify delivery:

   • ✅ Check the recipient's inbox (including spam/junk folders)
   • ✅ Verify the "From" address matches your configured email
   • ✅ Confirm the email content displays correctly

💡 Success indicator: If the test email is delivered successfully, your Microsoft 365 integration is working correctly.

10. Maintain the integration

1. Monitor the client secret expiry date and generate a new secret before it expires. Update the value in Axero whenever you rotate the secret.

2. If your organization uses SPF, DKIM, and DMARC, ensure the domain’s DNS records are correctly configured to avoid spam filtering.

3. Periodically review API permissions and remove any that are no longer needed to follow the principle of least privilege.

For additional assistance, contact Axero Support or consult your Microsoft 365 administrator.