Skip to content

Microsoft 365 setup for email sending

This guide connects a Microsoft 365 mailbox, such as [email protected], so your customer emails come from it. It's part of Email sending on the Enterprise plan.

You create the app in your own Microsoft account and give us its details. You stay in control: you can see, limit or delete the app at any time, and nothing we hold works without it.

Why an app, and why no sign-in

We send as your mailbox through the app's own permission, without anyone signing in. That means strict sign-in rules (conditional access), password changes and MFA prompts can't interrupt your customer emails. Because the app doesn't sign in as a person, it's important to limit it to the one mailbox you send from. Step 3 shows how.

Before you start

You need:

  • An Enterprise plan, and the Owner or Administrator role in FSM Navigator.
  • A Microsoft 365 administrator who can create app registrations in Microsoft Entra and run Exchange Online PowerShell (the Exchange Administrator role, or membership of the Organization Management role group).
  • The mailbox you'll send from. A user mailbox or a shared mailbox both work.
  • No custom sending domain on the Email Sending tab. You can use your own domain or Microsoft 365, not both. If you added a domain, remove it first.

The How to set up the app in Microsoft section on the Email Sending tab has the same steps, with the commands filled in for you.

Step 1: Register the app

  1. Sign in to Microsoft Entra with an account that can manage apps.
  2. Open App registrations and choose New registration.
  3. Give it a name you'll recognise, such as "FSM Navigator email".
  4. Under supported account types, choose Accounts in this organizational directory only.
  5. Leave the redirect URI empty. You don't need one.
  6. Choose Register.

On the app's Overview page, copy the Directory (tenant) ID and the Application (client) ID. You'll enter both in FSM Navigator.

Step 2: Create a client secret

  1. In the app, open Certificates & secrets and choose New client secret.
  2. Add a description and pick when it expires.
  3. Copy the secret's Value straight away. Microsoft shows it only once. Don't copy the Secret ID; that's a different value and won't work.
  4. Note the expiry date shown next to the secret.

You'll enter the value and the expiry date in FSM Navigator. We remind you 30 days before the secret expires.

This is the safest setup: the app can send from, and read message details of, that one mailbox only. It uses Exchange Online's role-based access for applications.

First, find the app's Object ID: open Enterprise applications in Microsoft Entra (not App registrations, which shows a different Object ID), open your app and copy its Object ID.

Then open Exchange Online PowerShell and run these commands in order. On the Email Sending tab, type the Object ID into Object ID of the app and the commands fill in your Application ID, Object ID and sending mailbox, each with a Copy button. The Object ID only fills in the commands; it isn't saved.

Connect-ExchangeOnline

New-ServicePrincipal -AppId <Application ID> -ObjectId <Object ID> -DisplayName "FSM Navigator email"

New-ManagementScope -Name "FSM Navigator sending mailbox" -RecipientRestrictionFilter "PrimarySmtpAddress -eq '<sending mailbox>'"

New-ManagementRoleAssignment -App <Object ID> -Role "Application Mail.Send" -CustomResourceScope "FSM Navigator sending mailbox"

New-ManagementRoleAssignment -App <Object ID> -Role "Application Mail.ReadBasic" -CustomResourceScope "FSM Navigator sending mailbox"

Test-ServicePrincipalAuthorization -Identity <Object ID> -Resource <sending mailbox>

What each one does:

  1. Connect-ExchangeOnline signs you in to Exchange Online.
  2. New-ServicePrincipal tells Exchange Online about your app.
  3. New-ManagementScope creates a scope that holds only your sending mailbox.
  4. The first New-ManagementRoleAssignment lets the app send from that mailbox only.
  5. The second lets the app read the details of messages in that mailbox only (sender, subject and dates, never the message body or attachments). We use this to spot "Undeliverable" notices, so a bounced customer address is caught just like on any other sending option.
  6. Test-ServicePrincipalAuthorization checks the result. It should show InScope True for both roles.

Don't also add mail permissions in Microsoft Entra

Don't add Mail.Send or Mail.ReadBasic.All under API permissions in Microsoft Entra as well. Microsoft adds the two kinds of permission together, so the app could then reach every mailbox in your organization and the limit above would have no effect. If you added them earlier, remove them.

Changes in Exchange Online can take 30 minutes to 2 hours to apply. If FSM Navigator says the app isn't allowed yet, wait and use Check again.

Simpler but broader (not recommended)

Instead of Step 3, you can open API permissions in the app, choose Add a permission, then Microsoft Graph, then Application permissions, add Mail.Send and Mail.ReadBasic.All, and grant consent for your organization.

This lets the app send as, and read message details of, every mailbox in your organization. Use the one-mailbox setup above unless you have a reason not to.

Step 4: Set the mailbox's display name

Microsoft 365 always shows the mailbox's own display name as the sender, so that's the name your customers see. In Microsoft 365, set the sending mailbox's display name to your business name, such as "Acme Plumbing". The Sender name field on the Email Sending tab applies only to sending from your own domain.

Step 5: Connect it in FSM Navigator

  1. Open Company Settings, then the Email Sending tab, and find the Microsoft 365 card.
  2. Under Your app details, enter:
    • Directory (tenant) ID
    • Application (client) ID
    • Client secret value (the Value, not the Secret ID)
    • Secret expiry date
    • Sending mailbox, such as [email protected]
  3. Choose Save and validate. We check the details with Microsoft straight away. No email is sent.

After you save, we never show the secret again; the card shows only its last four characters. Once the connection shows Connected, your emails switch to Microsoft 365 on their own, unless you've already chosen a sending option yourself.

Status What it means
Connected Working. Customer emails come from your mailbox.
Not checked yet Saved, but not yet confirmed with Microsoft. Use Check again.
Busy Microsoft asked us to slow down. Emails keep going out.
Not accepted Microsoft didn't accept the app details. Check the IDs and the secret.
Secret rejected The client secret is wrong or has expired. Replace it.
Not allowed The app doesn't have permission for the mailbox. Check Step 3, or wait for the change to apply.
Mailbox not found The sending mailbox doesn't exist. Check the address.

If the connection stops working, your customer emails go out from FSM Navigator's address under your business name, with replies going to your mailbox, until it's fixed. We email the Owner and the Administrator once when it happens.

Replace the client secret before it expires

Client secrets expire on the date you picked. We remind you 30 days before, and the card shows Secret expires soon.

  1. In Microsoft Entra, open your app, then Certificates & secrets, and create a new client secret. Copy its Value and expiry date.
  2. On the Microsoft 365 card, choose Replace secret.
  3. Enter the new secret value and its expiry date, then choose Save new secret.

We test the new secret before using it, so your emails keep sending if it doesn't work. Once it's working, you can delete the old secret in Entra.

Change or disconnect

  • Change app details lets you enter new IDs or a different mailbox. It asks for the client secret again.
  • Disconnect stops sending through Microsoft 365. Your emails go back to coming from FSM Navigator's address. To remove our access completely, also delete the app in Microsoft Entra.