Microsoft Graph Accounts
For Microsoft 365, Graph is the modern connection for both sending and collecting.
Where to find it
Architect Panel → Integration & Connections:
- E-mail Accounts — the accounts mail is sent and received through
Architect Panel → Integration & Connections:
- Azure AD Tenants — the Microsoft application registration
Why it is the right choice there
Microsoft has been steadily disabling basic authentication, which is what SMTP, IMAP and POP3 rely on. Organisations that have not moved find mail integrations failing on a date set by Microsoft rather than by them.
Graph does not depend on it, so it does not break when that happens.
What it needs
An application registered in the organisation's Microsoft tenant, with permission to send and read mail for the mailbox in question, and the resulting identifiers and secret.
That is more setup than a username and password, and it is why it does not break.
Administrator consent is usually required
The step that catches people out. Mail permissions typically require a Microsoft administrator to consent on behalf of the organisation — a person who may not be you, and may need convincing.
Plan for that conversation rather than discovering it mid-configuration. Being able to say precisely which permissions you need, and for which mailbox, makes it much shorter.
Ask for the minimum, on the narrowest scope
Permission to read and send mail across an entire organisation is a lot to hold. Where Microsoft allows scoping the application to specific mailboxes, do that — it is a smaller ask, easier to get consented, and a much smaller thing to have if the credential leaks.
The secret expires
As with any Microsoft application registration, and when it does, mail stops entirely — sending and collecting both, at once.
Diary the renewal when you create it, choose the longest permitted lifetime, and record who in the Microsoft tenant can renew it. That last one matters: on the day it expires you need somebody with rights there, and it may not be anybody in your team.
It covers both directions
One connection serves sending and collecting, which is simpler than maintaining SMTP and IMAP separately with two sets of credentials that expire on different dates.
Test both directions
Send a message and collect one. It is entirely possible to configure permissions that allow one and not the other, and finding out later means going back to whoever consented.
Worked example
An organisation registers an application scoped to one shared mailbox, obtains administrator consent with a written list of the permissions and why, and uses it for both sending and collection. The secret is diarised at twenty-two of its twenty-four months, with the Microsoft administrator named alongside it.
Recommendations
- Use Graph on Microsoft 365 — basic authentication is going away.
- Scope to specific mailboxes where you can.
- Prepare for the consent conversation.
- Diary the secret, and record who can renew it.