For Office 365 mailboxes, Microsoft Graph is the modern API and is generally preferred over SMTP/IMAP. More reliable than SMTP AUTH (which Microsoft is increasingly restricting), avoids storing passwords, and supports the full Graph feature set including richer search and folder operations.
Why prefer Graph over SMTP for Office 365
Three reasons:
1. Modern OAuth — no stored password
Graph uses OAuth 2.0 client-credentials flow. The platform stores a client ID and client secret, not a user password. Compromise of the credentials gives access to the configured mailbox only, scoped by the Graph permissions you granted — much narrower blast radius than a stored mailbox password.
2. Bypasses Microsoft's SMTP AUTH restrictions
Microsoft has been progressively disabling Basic Auth (SMTP with username+password) for Office 365 tenants. Many tenants now have it disabled by default for new mailboxes. Graph doesn't have this problem — it's the supported modern path.
3. Better operational features
Better deliverability statistics, more accurate bounce reporting, native folder operations (move processed messages to a sub-folder cleanly), full-text mailbox search.
Setup
Five steps:
- Register an application in Azure AD. Go to portal.azure.com → Azure Active Directory → App Registrations → New Registration. Pick a name (e.g. "ActiveManage E-mail"), single tenant, no redirect URI needed for client-credentials flow.
- Note the Tenant ID, Client ID from the app's Overview page.
- Create a Client Secret under Certificates & Secrets. Copy the value immediately — it's only shown once.
- Grant Mail.Send and Mail.Read permissions under API Permissions. Mail.Send for outbound, Mail.Read (or Mail.ReadWrite) for inbound. Grant admin consent.
- In ActiveManage, create an E-mail Account with Send Mode = Microsoft Graph (and/or Receive Mode = Microsoft Graph), enter the Tenant ID, Client ID, Client Secret, and the target mailbox address.
Token refresh
Graph uses OAuth tokens that expire (typically after 1 hour). The platform refreshes them automatically using the configured app credentials — you don't need to do anything ongoing.
If the client secret expires (Azure secrets have a max lifetime, typically 1-2 years), generate a new one and update the E-mail Account. The platform notifies you when it can't refresh tokens.
Permissions granularity
The default Graph permissions (Mail.Send, Mail.Read) grant access to all mailboxes in the tenant. For tighter scoping:
- Use Application Access Policies in Exchange Online to restrict the app's access to specific mailboxes only.
- Or use delegated permissions instead of application permissions if the app should act on behalf of a specific user.
Three real-world Graph setups
Example 1: Transactional sender from a service account
App registered with Mail.Send only. Restricted via Application Access Policy to one mailbox noreply@acme.com. Used for all transactional outbound.
Example 2: Bidirectional support inbox
App registered with Mail.Send + Mail.ReadWrite. Scoped to support@acme.com. Used for both inbound ticket creation and outbound reply sending.
Example 3: Multi-mailbox setup
One app registration with broad permissions. Multiple E-mail Accounts in ActiveManage, each pointing at a different mailbox in the same tenant.
