> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365 email

> Send Triggr email, such as approval requests and workflow notifications, from a mailbox in your MSP's Microsoft 365 tenant.

Triggr sends approval requests and workflow notifications through Microsoft Graph from a mailbox in your MSP's tenant, using Triggr's own Entra app (application ID `93d55b6f-8b1c-41c6-845d-0bd579b3e68b`). Admin consent gives the app `Mail.Send` across your tenant, which you can [limit to one mailbox](#limit-the-app-to-the-sending-mailbox).

## Set up Microsoft 365

Create a dedicated mailbox in the tenant, such as `notifications@yourdomain.com`: a [shared mailbox](https://learn.microsoft.com/en-us/microsoft-365/admin/email/create-a-shared-mailbox) (no licence needed under 50 GB) or a user mailbox licensed for Exchange Online.

## Connect it in Triggr

You need a Global Administrator or Privileged Role Administrator in the tenant.

<Steps>
  <Step title="Open the integration">
    Go to **Integrations > Microsoft Email** and click Configure on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter your tenant ID">
    Enter your TenantID, or click Lookup By Domain to find it, leave ClientID and ClientSecret as they are and click Save Configuration.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/microsoft-365-email/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=7551a6aca1118a625e04b9dd407e2f11" alt="The Microsoft Email configuration window with ClientID and ClientSecret already filled in (blurred), an empty TenantID field with a Lookup By Domain link, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1354" data-path="images/microsoft-365-email/configure.png" />
    </Frame>
  </Step>

  <Step title="Grant admin consent">
    Click **Admin Consent** on the card, sign in as an administrator of the same tenant and select Accept. The card's Admin Consent status changes to Granted.
  </Step>
</Steps>

## Create a sending profile

Go to **Settings > Sending Profiles**, click New Profile, set Profile Type to Microsoft, enter a unique Name (up to 50 characters) and the mailbox as From Email, then click Create Profile.

<Frame>
  <img src="https://mintcdn.com/triggr/XztmSfsoAUpshfIO/images/studio/settings/sending-profile-microsoft.png?fit=max&auto=format&n=XztmSfsoAUpshfIO&q=85&s=4babf681c379ceb9f5e39bdb0b0da760" alt="The Create New Sending Profile dialog with Profile Type Microsoft, Name Service desk (Microsoft) and From Email servicedesk@yourmsp.com, and Cancel and Create Profile buttons." width="1024" height="708" data-path="images/studio/settings/sending-profile-microsoft.png" />
</Frame>

Choose the profile in Sending Profile on a Send Email or Await Form Submission step, or as the approval sender in Triggr Core. Steps without one send from `app@triggr-app.com`. See [Sending profiles](/studio/settings/sending-profiles).

## Limit the app to the sending mailbox

This uses [RBAC for Applications in Exchange Online](https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac) and needs the [Exchange Online PowerShell module](https://learn.microsoft.com/en-us/powershell/exchange/connect-to-exchange-online-powershell) and the Organization Management role group. Grant admin consent first.

<Steps>
  <Step title="Find the app's object ID">
    In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID > Enterprise apps > All applications** (not App registrations), search for `93d55b6f-8b1c-41c6-845d-0bd579b3e68b` and copy its Object ID.
  </Step>

  <Step title="Grant Mail.Send for the mailbox only">
    ```powershell theme={null}
    Connect-ExchangeOnline

    New-ServicePrincipal -AppId 93d55b6f-8b1c-41c6-845d-0bd579b3e68b -ObjectId <object-id> -DisplayName "Triggr"

    New-ManagementScope -Name "Triggr sending mailbox" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'notifications@yourdomain.com'"

    New-ManagementRoleAssignment -App 93d55b6f-8b1c-41c6-845d-0bd579b3e68b -Role "Application Mail.Send" -CustomResourceScope "Triggr sending mailbox"
    ```
  </Step>

  <Step title="Check the assignment">
    ```powershell theme={null}
    Test-ServicePrincipalAuthorization -Identity 93d55b6f-8b1c-41c6-845d-0bd579b3e68b -Resource notifications@yourdomain.com
    ```

    Application Mail.Send should show InScope `True`, and `False` for any other mailbox.
  </Step>

  <Step title="Remove the tenant-wide permission">
    Open the app under Enterprise apps and select Permissions. On the Admin consent tab, select **...** next to Mail.Send, then **Revoke permission**. This needs at least Cloud Application Administrator.
  </Step>
</Steps>

Changes take 30 minutes to 2 hours to apply. Add mailboxes later with `Set-ManagementScope`. Clicking Admin Consent again grants `Mail.Send` tenant-wide again, so revoke it afterwards.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Lookup By Domain can't find the tenant">
    Use a domain verified in your tenant, such as your `.onmicrosoft.com` domain, or paste the Tenant ID from Entra ID > Overview into TenantID.
  </Accordion>

  <Accordion title="Admin consent fails">
    Sign in as a Global Administrator or Privileged Role Administrator of the tenant in TenantID. Application and Cloud Application Administrators can't consent.
  </Accordion>

  <Accordion title="Sending fails with &#x22;failed to get Microsoft OAuth access token&#x22;">
    Check TenantID and that Admin Consent shows Granted. If ClientID or ClientSecret were changed, click Unlink, configure again and grant consent again.
  </Accordion>

  <Accordion title="Sending fails with ErrorAccessDenied">
    The app can't send as the From Email mailbox. Check it's in the management scope with `Test-ServicePrincipalAuthorization`, and allow up to 2 hours for changes.
  </Accordion>

  <Accordion title="Sending fails for one mailbox">
    From Email must match a mailbox in the connected tenant exactly: a shared mailbox, or a user mailbox licensed for Exchange Online.
  </Accordion>

  <Accordion title="Emails go to junk">
    Set up SPF, DKIM and DMARC for Exchange Online. See Microsoft's [email authentication guidance](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about).
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.