Connect Microsoft 365

A Microsoft 365 connection is a mailbox, in a work or school account or an Outlook.com account, that Marketing sends mail from, so that replies reach a person. It sends only; it does not read the mailbox. It is your org's or a brand's. See Connections for how connecting works in general.

Ways to connect

• Connect, through GreenMind's app, where it is open to your org.
• Use your own app: an app registration in Microsoft Entra. Start at Entra's app registrations; Microsoft's quickstart for registering an app explains the rest.

There is no key option.

Making your own app

Microsoft's screens change from time to time. Follow the dialog and Microsoft's documentation where this page and Microsoft's screens differ.

1. Open the Use your own app dialog for Microsoft 365 on the Connections page, and keep it open.
2. In Entra, open App registrations and choose New registration. Name it, and for supported account types choose accounts in any organizational directory and personal Microsoft accounts, so that any mailbox can connect.
3. Add the redirect URL. Open Authentication, choose Add a platform, then Web, and enter the redirect URL from the dialog, copied exactly.
4. Add the permissions. Open API permissions, choose Add a permission, then Microsoft Graph, then Delegated permissions, and add the permissions below.
5. Make the secret. Open Certificates & secrets and choose New client secret. Copy the secret's value straight away, because Entra shows it once. Copy the registration's Application (client) ID from its overview.
6. Paste both into the dialog and press Connect. Sign in to Microsoft as the mailbox that should send, and allow it.

Permissions

All are delegated, which means they act as the signed-in mailbox:

Mail.Send User.Read offline_access

Verification and tenants

A registration that any organization can use, with no verified publisher, shows as "unverified" on Microsoft's consent screen, and a tenant that requires administrator approval or has stricter consent rules may refuse it until an administrator allows it. Publisher verification is Microsoft's process; its documentation explains it. For your own mailboxes in your own tenant it does not matter.

If it goes wrong

• Redirect URI mismatch. The redirect URI under Authentication differs from the dialog's, or was added to the wrong platform type. It must be under Web.
• Invalid client secret. The secret was copied as its ID rather than its value, has expired, or was replaced. Make a new secret and Reconnect.
• An administrator must approve the app. The tenant restricts who can consent to apps. Ask its administrator to approve it, or to grant consent.
• Disconnecting does not revoke at Microsoft. Microsoft has no revoke call for this, so Disconnect erases the tokens here and tells you to remove the app's access in the Microsoft account yourself.