| Table of Contents | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| Note |
|---|
HTTPS Required - – Microsoft requires mandates that the requesting application to be hosted via over HTTPS. A FlexDeploy installation using only using HTTP will not be able to use support Microsoft OAuth. |
Create the Application in Azure AD
Register a New App
Navigate to the Azure portal and select Azure Active Directory from the browser. Once there click on App Registrations and register a new app.
...
Add the Redirect URI
Give your app a name and set the web redirect URI.
| Info |
|---|
This should be your FlexDeploy server with the following path /flexdeploy/rest/v2/oauth |
...
Request Permissions
After clicking register copy the client id and tenant id on the home page of the application. Next click on API Permissions
...
On the API Permissions screen, click Add a Permission and select Microsoft Graph → Delegated Permissions.
...
You will need to add the following permissions:
IMAP.AccessAsUser.All
offline_access
SMTP.Send
User.Read
...
| Note |
|---|
You may need your admin to grant consent for the permissions above, which they can do by navigating to the same screen as above and hitting the currently disabled ‘Grant admin consent’ button |
Add a Client Secret
Finally, navigate to Certificates & secrets on the left hand panel, create a client secret and copy that to safe location.
| Info |
|---|
Be sure to copy the value of the secret. The secret id is not needed. |
...
Update FlexDeploy System Settings
Match the Server Base URL
First, make sure your FlexDeploy Server Base Url in General Settings matches what you entered in Azure Application redirect.
...
Populate OAuth Information
Next, select Microsoft OAuth for the SMTP auth type in Email Settings and add:
SMTP Host Name - smtp.outlook.com
SMTP User
Client Id
Client Secret
Tenant Id
...
Authorize and Validate
In order to authorize, you should login to http://outlook.com as the user you wish to authorize as first. Otherwise, especially if you are using SSO, it is likely that you will be authorizing as the wrong user. The idea is that when you click authorize, it will ask you who to login as, and you will select (or type) the same user that you have in the imap user / smtp user box that you are authorizing.
After populating the necessary fields, click either the Authorize or Re-Authorize buttons. At this point you will be re-directed to Microsoft to authorize FlexDeploy as the same user that you have in the imap user / smtp user box that you are authorizing. If everything is successful you should be redirected back to this page:
...
or
...
Prerequisites
See Creating and connecting to an Office 365 email application compatible with FlexDeploy for directions to create a suitable application in Azure and connect it with FlexDeploy. Then resume with next section when ready.
Update FlexDeploy System Settings
Outgoing Email Settings
Next, go to System Settings → Email Settings and select OAuth for the outgoing and incoming auth types.
User Name - This must match the user who completed the Authorize action for Microsoft Azure application on the System Settings - Integration Settings page.
OAuth Application - Choose the OAuth application you just created.
From Address - The user must have permission to send from this address, or it won’t work. This can be a shared mailbox.
...
Incoming Email Settings
If you are using the same user for outgoing and incoming emails (recommended) then you can leave the top of the section titled Incoming Email Settings mostly blank. Follow notes provided on Description of each setting.
...
Email Reply Options
Email Reply Folder - This is the folder (can be a shared folder) that will have all mail processed and deleted from it by FlexDeploy. You cannot use the same folder for dev and prod FlexDeploy servers, as one of the servers will read and delete the mail, and the other will not get the mail. You could use one user account, as long as you use separate folders. Inbox is likely the value that you want. However, if you use Inbox, and test it with your personal email address, all your email will be irrecoverably lost.
Approval Reply Address - This defaults to the same as the From Address, and works with shared mailboxes. When users click reply to the emails FlexDeploy send, it should be routed into the folder that you specified above.
Validate
Once authorization is complete, you can test the configuration by clicking on the Test Email Configuration button located at the bottom next to Save.
Sends a test email to the logged in user's email address to validate the SMTP Outgoing OAuth settings.
Reads the inbox of the Approval Reply Address to validate the IMAP Incoming OAuth settings.
...
Once you test
If you authorized as the wrong user, you will get the error:
Bad User is Authenticated But Not Connected
If you get that, use an incognito tab to reauthorize as the correct user using the directions found Creating and connecting to an Office 365 email application compatible with FlexDeploy , and then test again. Similarly, if you authorized as one user and need to authorize as a different user in the same session, then make sure to sign out of Microsoft first (usually this would be signing out of https://portal.microsoftonline.com). You may also want to run just this step with FlexDeploy from on Incognito or inprivate browser. Otherwise, the first user’s credentials will automatically be used with the authorization instead of prompting you to login as the second user. You will see this error when testing the email configuration:
...