Microsoft 365 OAuth2

⚠️ Advanced setup. For Microsoft 365 we recommend the Microsoft 365 Connect type: just sign in with the mailbox and authorize.

Microsoft 365 OAuth2 is only advisable for those who have in-house IT and want the setup on their organization’s side (for example, due to internal security rules).

🔁 Warning: the application secret (client secret) expires after 24 months at most. When it expires, email sending stops until a new secret is created and updated in GC. Mark the expiry date in your calendar.

1. Register the application in Azure

With an administrator account, at entra.microsoft.com › App registrations › New registration:

  1. Name: for example, “GC”.
  2. Supported account types: Accounts in this organizational directory only (Single tenant).
  3. Redirect URI: Web platform, with the Redirect Uri that GC shows on the account (see step 2). You can add it later under Authentication.
  4. Click Register. In Overview, save the Application (client) ID and the Directory (tenant) ID.
  5. API permissions › Add a permission › Microsoft Graph › Delegated permissions: SMTP.Send, IMAP.AccessAsUser.All and offline_access.
  6. Certificates & secrets › New client secret: choose the validity (maximum 24 months) and copy the Value (it is only shown once).
  7. In the Exchange admin center, confirm that the mailbox has Authenticated SMTP turned on (Recipients › Mailboxes › the mailbox › Manage email apps settings › Authenticated SMTP). In recent organizations it must also be allowed at the organization level (Settings › Mail flow).

2. Set up in GC

Go to Administration >> Email >> Sending Accounts, click Add and choose the Microsoft 365 OAuth2 type.

  1. Fill in Username (the mailbox address), E-Mail: From, Name, Tenant Id, Client Id and Client Secret (the secret’s Value), and save.
  2. GC shows the Redirect Uri to register in Azure (step 1.3).
  3. Click Consent, sign in with the mailbox and authorize.
  4. Click Test.

📥 Reading replies

With Read and answer replies on, GC reads the mailbox over IMAP and looks for replies only in the Inbox. For that, the Azure application must have the IMAP.AccessAsUser.All permission (step 1.5) and the mailbox must have IMAP enabled (Recipients › Mailboxes › the mailbox › Manage email apps settings › IMAP).

If Test sends but cannot read, we recommend switching the account to Microsoft 365 Connect: it looks for replies in every folder and has no secret to renew.

🔁 Renew the secret before it expires

  1. In Azure, in the same application, create a new client secret and copy the Value.
  2. In GC, on the sending account, replace the Client Secret and save (no new consent is needed).
  3. Click Test and, if it went well, delete the old secret in Azure.

To stop having to renew secrets, switch the account to Microsoft 365 Connect.