--- title: "Configure OAuth 2.0 authentication for SMTP and IMAP via Azure" slug: "configure-oauth2-0-authentication-for-smtp-and-imap-via-azure" updated: 2026-09-01T19:49:30Z published: 2026-09-01T19:49:30Z canonical: "docs.senhasegura.io/configure-oauth2-0-authentication-for-smtp-and-imap-via-azure" stale: true --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.senhasegura.io/llms.txt > Use this file to discover all available pages before exploring further. # Configure OAuth 2.0 authentication for SMTP and IMAP via Azure Segura® Platform authenticates Microsoft-hosted SMTP and IMAP mail accounts with OAuth 2.0 through a native Authenticate flow. This flow replaces the `email-oauth2-proxy` component for Microsoft accounts and works in multi-tenant environments. Segura® supports two OAuth2 flows for Microsoft accounts. You choose the flow with the **Microsoft OAuth2 flow** field on the SMTP account. For a field-level reference, see [SMTP configuration](/v4-2/docs/smtp-configuration). - **Delegated (user consent)**: the default. A user signs in interactively and grants consent; Segura® sends emails on behalf of that user's mailbox. - **Application (admin consent, app-only)**: a tenant administrator grants consent once, with no user sign-in at send time. Use it in tenants that require administrator approval for new applications, where the Delegated flow cannot complete because the approval is asynchronous. This document covers the Azure setup, the credential, and the SMTP account. The Azure application and credential you create here also authenticate IMAP. To configure the IMAP account itself, see [Manage IMAP/POP3 settings](/v4-2/docs/how-to-manage-imappop3-settings). Info The native flow applies to Microsoft-hosted mail accounts only, identified by host: `office365.com`, `outlook.com`, `outlook.office365.com`, `smtp.office365.com`, `smtp-mail.outlook.com`, `imap-mail.outlook.com`, `pop-mail.outlook.com`, `live.com`, `hotmail.com`, and `onmicrosoft.com`. For any other provider, use the `email-oauth2-proxy` method: see [Register the email-oauth2-proxy component](/v4-2/docs/register-the-email-oauth2-proxy-component). ## Requirements - Administrative access to the Microsoft Azure Portal, including rights to grant the requested permissions. - Administrative access to Segura® Platform. - The Segura® Platform URL, to register as the Azure redirect URI. - If you use the Application (app-only) flow, a Microsoft Entra ID administrator must grant admin consent for the application. ## Register an application in Azure Attention The Azure setup steps in this section take place in Microsoft Azure. Microsoft can change this interface and process without notice. If the screens differ from what is described here, consult Microsoft's documentation. 1. [Access the Azure Portal](https://portal.azure.com/) and log in to your Azure account. 2. Locate the service Microsoft Entra ID. 3. In the left menu, select **Manage > App registrations**. 4. Select your existing mail application, or select **New registration** to create one. 5. In the application's left menu, select **Manage > Authentication**. 6. Under **Web > Redirect URIs**, add or update the URI so that it ends with `flow/mail/auth/return`. Use the following format, and match it exactly, including the scheme: ``` https:///flow/mail/auth/return ``` 1. From the application's **Overview** page, copy the **Application (client) ID** and the **Directory (tenant) ID**. You need both values later. ## Generate a client secret 1. In the application's left menu, select **Manage > Certificates & secrets**. 2. Select **New client secret**. 3. In the **Description** field, enter a description for the client secret. 4. In the **Expires** field, select when the client secret expires. 5. Select **Add**. Alert Copy the **Value** field of the client secret immediately. Azure hides this value after you leave the page, and you cannot retrieve it later. ## Configure API permissions The Microsoft Graph permissions to add depend on the OAuth2 flow you will use on the SMTP account. ### Delegated flow (default) 1. In the application's left menu, select **Manage > API permissions**. 2. Select **Add a permission**, then select Microsoft Graph. 3. Select **Delegated permissions**. 4. Add the following permissions: 1. **Mail.Send**: supports sending through SMTP. 2. **Mail.Read**, labeled **Read user mail**: supports reading through IMAP. 5. Select **Add permissions**. Info Azure lists several read permissions with similar names. Select the one labeled **Read user mail**. A user grants consent to these permissions during the Authenticate step, when they log in to Microsoft. ### Application flow (app-only) 1. In the application's left menu, select **Manage > API permissions**. 2. Select **Add a permission**, then select Microsoft Graph. 3. Select **Application permissions**. 4. Add the permission **Mail.Send**, labeled **Send mail as any user**. 5. Select **Add permissions**. A tenant administrator grants consent for this permission during authentication, by approving the request in the Azure Portal. For those steps, see [Authenticate with Microsoft](/docs/configure-oauth2-0-authentication-for-smtp-and-imap-via-azure#authenticate-with-microsoft). Info Security recommendation (least privilege): with the application **Mail.Send** permission, the application can send as any mailbox in the tenant. Restrict the application to the configured sender mailbox with an Application Access Policy in Exchange Online. ## Create a credential in PAM Core 1. On Segura®, in the navigation bar, hover over the **Products** menu and select PAM Core. 2. Go to **Credentials > All credentials**, and select **Add**. 3. On the **Information** tab, complete the following fields: 1. **Username**: enter the Application (client) ID you copied earlier. 2. **Device**: enter the mail provider's host, for example `outlook.office365.com` for a Microsoft 365 account, or `outlook.live.com` for a personal Microsoft account. 3. **Password type**: select **Local user**. 4. **Additional information**: enter the Directory (tenant) ID you copied earlier. 5. **Password**: enter the client secret value you copied earlier. 4. Select **Save**. Info If the mailbox is a personal Microsoft account, Segura® Platform always uses the tenant value `common`, regardless of the Directory (tenant) ID stored in this credential. ## Configure the SMTP account 1. On Segura®, in the navigation bar, hover over the **Products** menu and select **Settings**. 2. On the side menu, select **Email > SMTP configuration**. For the general account fields not covered here, such as account name, sender email, and reply email, see [Manage SMTP settings](/docs/how-to-manage-smtp-settings). 3. Add a new account, or edit an existing one, for the Microsoft mailbox. 4. Complete the following fields: 1. **Host SMTP**: enter the provider's host, for example `smtp.office365.com`. 2. **Port**: enter `587`. 3. **Use safe connection?**: select **No**. 4. **Ignore certificate error**: select **Yes**. 5. **Enable footnote**: select **No**. 5. In the **Use authentication?** field, select **Yes**. 6. In the **Credential for authentication** field, select the credential you created in [Create a credential in PAM Core](/docs/configure-oauth2-0-authentication-for-smtp-and-imap-via-azure#create-a-credential-in-pam-core). 7. In the **Microsoft OAuth2 flow** field, select **Delegated (user consent)** or **Application (admin consent, app-only)**, to match the permissions you configured in Azure. The default is **Delegated**. 8. Select **Send**. ## Authenticate with Microsoft After you save the SMTP account, authenticate it with Microsoft. The steps depend on the OAuth2 flow you selected. ### Delegated flow 1. In the accounts list, select the **Actions** button for the account, then select **Authenticate**. 2. Segura® Platform displays a message: it will redirect you to Microsoft for authentication, and you will need to log in to Segura® Platform again afterward. Select **Yes** to continue. 3. On the Microsoft screen, select the sender account to authenticate. 4. On the **Permissions requested** screen, review the access and select **Accept**. 5. Segura® Platform displays **Success - Authenticated successfully**. 6. Select **Back to login**, then log in to Segura® Platform again. ### Application (app-only) flow Use these steps when the account uses the Application flow, where a tenant administrator must approve the request before authentication completes. 1. In the accounts list, select the **Actions** button for the account, then select **Authenticate**. 2. In the redirect confirmation, select **Yes**. 3. On the Microsoft screen, select the sender account to authenticate. 4. On the **Approval required** screen, enter a justification and select **Request approval**. Microsoft confirms with **Request sent**. Select **Return to the application**. 5. Segura® Platform displays **Consent not completed**. This is expected: a tenant administrator must approve the request. Select **Back to login**. 6. Ask a Microsoft Entra ID administrator to approve the request in the Azure Portal: 1. Go to **Enterprise applications > Admin consent requests** and select the pending request. 2. Select **Review permissions and consent**, then sign in with the administrator account. 3. Confirm **Consent on behalf of your organization**, then select **Accept**. 7. Return to Segura® Platform and repeat the **Authenticate** action. Because consent was granted, Microsoft redirects you back automatically, and Segura® Platform displays **Consent completed**. 8. Select **Back to login**, then log in to Segura® Platform again. ### Test the configuration 1. In the accounts list, select the **Actions** button for the authenticated account, then select **Test setting**. 2. On the **Test Email - Account** form, enter a destination address in **Send to**, then select **Send**. 3. When Segura® Platform displays **Test email successfully sent**, select **Continue**. 4. To audit the send, go to **Settings > Email > Outbox** and confirm the record status is **Sent**. 5. Check the recipient inbox to confirm the test message arrived. Info If a test send fails, check the message **Sending via Microsoft Graph failed. Check whether the application permission was approved by the administrator (it may take a few moments to propagate).** Confirm that administrator consent was granted and retry. ## Related topics - [SMTP configuration](/v4-2/docs/smtp-configuration). - [Manage SMTP settings](/v4-2/docs/how-to-manage-smtp-settings). - [Manage IMAP/POP3 settings](/v4-2/docs/how-to-manage-imappop3-settings).