Configure Axero to send email from a Microsoft 365 account using OAuth 2.0 (modern authentication) over Office 365 Exchange Online. This method is preferred over legacy SMTP basic authentication.
This applies to Microsoft 365 work or school mailboxes, the accounts people use in Outlook. Consumer Outlook.com, Hotmail, and Live accounts use different settings and are not covered here.
You need the following:
Microsoft 365 License
Required License: Microsoft 365 Business Standard or higher with Exchange Online Plan 1 or Plan 2
Shared mailboxes cannot be used unless they are converted to licensed accounts
Administrative Access: You will need the following roles:
Microsoft Entra ID: Global Administrator or Application Administrator to register the application and grant API permissions (https://entra.microsoft.com)
Microsoft Exchange Online: Exchange Administrator to manage tenant-wide SMTP settings (https://admin.exchange.microsoft.com)
Microsoft 365 Admin Center: User Administrator or Global Administrator to manage user-specific SMTP settings (https://admin.microsoft.com)
Sign in to the Microsoft Entra portal at https://entra.microsoft.com with a Global Admin or Application Admin account.
In the left navigation, select Entra ID > App registrations, then click New registration.
Enter a descriptive name for the app (for example, "Axero Email Integration").
Set Supported account types to Accounts in this organizational directory only (single tenant).
Click Register.
After registration, record the following values (you'll need them later):
Validation checkpoint: Confirm you have recorded both the Directory (tenant) ID and Application (client) ID before proceeding.
In the registered app, click Authentication.
Click Add Redirect URI, and then Web.
Under Redirect URI, enter https://YOUR_AXERO_URL/oauth2/sharepoint/callback
https://YOUR_AXERO_URL/oauth2/sharepoint/callback
Replace YOUR_AXERO_URL with your Axero site address. Keep the /oauth2/sharepoint/callback path exactly as shown. It is correct for email even though it mentions SharePoint, so do not change it.
YOUR_AXERO_URL
/oauth2/sharepoint/callback
Click Configure.
Validation checkpoint: Verify the redirect URI is correctly formatted with your actual Axero URL.
In the registered app, open Certificates & secrets and click New client secret.
Provide a descriptive description (for example, "Axero Email Secret") and choose an expiry period.
Click Add.
Copy the Value of the newly created client secret. This value is shown only once. Store it securely alongside the Client ID and Tenant ID from Step 2.
Validation checkpoint: Confirm you have securely stored all three values: Tenant ID, Client ID, and Client Secret.
Axero authenticates to Microsoft 365 for mail through Office 365 Exchange Online, not through the Microsoft Graph mail API. The sending permission comes from that service.
In the registered app, open API permissions.
Click Add a permission, open the APIs my organization uses tab, then search for and select Office 365 Exchange Online.
Choose Delegated permissions. Axero sends as the configured user, which requires delegated access.
Select SMTP.Send, then click Add permissions. This scope lets Axero send email as the configured user over authenticated SMTP.
Click Add a permission again, select Microsoft Graph, choose Delegated permissions, add offline_access, and click Add permissions. This standard scope lets Axero refresh its access token without a new sign-in.
Click Grant admin consent for [your organization] and confirm. Each permission's Status should show a green check.
Validation checkpoint: Confirm that SMTP.Send (under Office 365 Exchange Online) and offline_access are listed and admin-consented.
Do not grant the Microsoft Graph Mail.Send permission instead. Axero does not use the Graph mail API, so a Graph-only mail permission leaves the connection unable to authenticate for sending. Microsoft Graph is used only for the OneDrive and SharePoint file features, never for email.
Also setting up email-to-case? Creating cases from incoming email reuses this same app registration, but it also reads a mailbox. Axero asks for both IMAP.AccessAsUser.All and POP.AccessAsUser.All together when incoming mail is turned on, both under Office 365 Exchange Online, so grant the pair even if you only intend to use one of the two protocols. That permission and the case project setup are covered in Set Up Email-to-Case. Sending, which this guide covers, does not need it.
Even though you are using modern authentication (OAuth), Microsoft still requires the underlying SMTP AUTH protocol to be enabled on the mailbox.
Go to the Exchange admin center: https://admin.exchange.microsoft.com.
Sign in with an Exchange Administrator account.
Go to Settings > Mail flow.
Ensure Turn off SMTP AUTH protocol for your organization is unchecked (disabled).
Click Save.
Validation checkpoint: Confirm that SMTP AUTH is enabled at the tenant level before proceeding to user-specific settings.
Go to the Microsoft 365 admin center: https://admin.microsoft.com.
Sign in with appropriate admin credentials (User Admin or Global Admin).
Go to Users > Active users.
Find and click the specific licensed user account that will be used to send email from Axero.
In the user's details pane that opens, select the Mail tab.
Click the Manage email apps link.
Ensure the Authenticated SMTP option is checked (enabled).
Click Save changes.
Validation checkpoint: Verify that SMTP AUTH is enabled for the specific user account that will send email from Axero.
Open a new browser window and sign in to your Axero site as a Site Administrator.
Go to Control Panel > System > General Settings > Email Settings.
Under SMTP server, enable Office 365.
Click Settings and enter the following configuration:
Click Save System Settings. The SMTP server and port shown in the form are defaults for display only; they are not stored until you save. If either is left blank, sending fails with "Invalid SMTP Office365 settings" even though the form looked complete.
Click Connect. You will be redirected to the Microsoft sign-in page.
Critical: Log out of any Microsoft admin accounts first, then sign in as the user who owns the licensed mailbox specified in the "From Email Address" field.
When prompted, accept the requested permissions to complete the authorization.
Upon successful authorization, scroll down and click Save System Settings.
Validation checkpoint: Verify that the connection was successful and no error messages are displayed in Axero.
In Axero, go to People > Manage People.
Select Send Email, or Options > Mass Email.
Select a test recipient (preferably yourself) and compose a test message with a clear subject line, for example "Axero Email Test" with today's date.
Send the email and verify delivery:
Success indicator: If the test email is delivered successfully, your Microsoft 365 integration is working correctly.
Monitor the client secret expiry date and generate a new secret before it expires. Update the value in Axero whenever you rotate the secret.
If your organization uses SPF, DKIM, and DMARC, ensure the domain's DNS records are correctly configured to avoid spam filtering.
Periodically review API permissions and remove any that are no longer needed, to follow the principle of least privilege.
Need help? Contact Axero Support or your Microsoft 365 administrator.
is requesting access to a wiki that you have locked: https://my.axerosolutions.com/spaces/5/axero-documentation/wiki/view/109152/microsoft-365-email-configuration
Your session has expired. You are being logged out.