Configure OAuth2.0 authentication for SMTP and IMAP via Azure

Segura® Platform authenticates Microsoft-hosted SMTP and IMAP mail accounts with OAuth2.0 through a native Authenticate flow. This flow replaces the email-oauth2-proxy component for Microsoft accounts and works in multi-tenant environments.

Segura® supports two OAuth2 flows for Microsoft accounts. You choose the flow with the Microsoft OAuth2 flow field on the SMTP account. For a field-level reference, see SMTP configuration.

• Delegated (user consent): the default. A user signs in interactively and grants consent; Segura® sends emails on behalf of that user's mailbox.
• Application (admin consent, app-only): a tenant administrator grants consent once, with no user sign-in at send time. Use it in tenants that require administrator approval for new applications, where the Delegated flow cannot complete because the approval is asynchronous.

This document covers the Azure setup, the credential, and the SMTP account. The Azure application and credential you create here also authenticate IMAP. To configure the IMAP account itself, see Manage IMAP/POP3 settings.

Requirements

• Administrative access to the Microsoft Azure Portal, including rights to grant the requested permissions.
• Administrative access to Segura® Platform.
• The Segura® Platform URL, to register as the Azure redirect URI.
• If you use the Application (app-only) flow, a Microsoft Entra ID administrator must grant admin consent for the application.

Register an application in Azure

1. Access the Azure Portal and log in to your Azure account.
2. Locate the service Microsoft Entra ID.
3. In the left menu, select Manage > App registrations.
4. Select your existing mail application, or select New registration to create one.
5. In the application's left menu, select Manage > Authentication.
6. Under Web > Redirect URIs, add or update the URI so that it ends with flow/mail/auth/return. Use the following format, and match it exactly, including the scheme:

https://<your-segura-url>/flow/mail/auth/return

7. From the application's Overview page, copy the Application (client) ID and the Directory (tenant) ID. You need both values later.

Generate a client secret

1. In the application's left menu, select Manage > Certificates & secrets.
2. Select New client secret.
3. In the Description field, enter a description for the client secret.
4. In the Expires field, select when the client secret expires.
5. Select Add.

Configure API permissions

The Microsoft Graph permissions to add depend on the OAuth2 flow you will use on the SMTP account.

Delegated flow (default)

1. In the application's left menu, select Manage > API permissions.
2. Select Add a permission, then select Microsoft Graph.
3. Select Delegated permissions.
4. Add the following permissions:
   1. Mail.Send: supports sending through SMTP.
   2. Mail.Read, labeled Read user mail: supports reading through IMAP.
5. Select Add permissions.

Application flow (app-only)

1. In the application's left menu, select Manage > API permissions.
2. Select Add a permission, then select Microsoft Graph.
3. Select Application permissions.
4. Add the permission Mail.Send, labeled Send mail as any user.
5. Select Add permissions.

A tenant administrator grants consent for this permission during authentication, by approving the request in the Azure Portal. For those steps, see Authenticate with Microsoft.

Create a credential in PAM Core

1. On Segura®, in the navigation bar, hover over the Products menu and select PAM Core.
2. Go to Credentials > All credentials, and select Add.
3. On the Information tab, complete the following fields:
   1. Username: enter the Application (client) ID you copied earlier.
   2. Device: enter the mail provider's host, for example outlook.office365.com for a Microsoft 365 account, or outlook.live.com for a personal Microsoft account.
   3. Password type: select Local user.
   4. Additional information: enter the Directory (tenant) ID you copied earlier.
   5. Password: enter the client secret value you copied earlier.
4. Select Save.

Configure the SMTP account

1. On Segura®, in the navigation bar, hover over the Products menu and select Settings.
2. On the side menu, select Email > SMTP configuration. For the general account fields not covered here, such as account name, sender email, and reply email, see Manage SMTP settings.
3. Add a new account, or edit an existing one, for the Microsoft mailbox.
4. Complete the following fields:
   1. Host SMTP: enter the provider's host, for example smtp.office365.com.
   2. Port: enter 587.
   3. Use safe connection?: select No.
   4. Ignore certificate error: select Yes.
   5. Enable footnote: select No.
5. In the Use authentication? field, select Yes.
6. In the Credential for authentication field, select the credential you created in Create a credential in PAM Core.
7. In the Microsoft OAuth2 flow field, select Delegated (user consent) or Application (admin consent, app-only), to match the permissions you configured in Azure. The default is Delegated.
8. Select Send.

Authenticate with Microsoft

After you save the SMTP account, authenticate it with Microsoft. The steps depend on the OAuth2 flow you selected.

Delegated flow

1. In the accounts list, select the Actions button for the account, then select Authenticate.
2. Segura® Platform displays a message: it will redirect you to Microsoft for authentication, and you will need to log in to Segura® Platform again afterward. Select Yes to continue.
3. On the Microsoft screen, select the sender account to authenticate.
4. On the Permissions requested screen, review the access and select Accept.
5. Segura® Platform displays Success - Authenticated successfully.
6. Select Back to login, then log in to Segura® Platform again.

Application (app-only) flow

Use these steps when the account uses the Application flow, where a tenant administrator must approve the request before authentication completes.

1. In the accounts list, select the Actions button for the account, then select Authenticate.
2. In the redirect confirmation, select Yes.
3. On the Microsoft screen, select the sender account to authenticate.
4. On the Approval required screen, enter a justification and select Request approval. Microsoft confirms with Request sent. Select Return to the application.
5. Segura® Platform displays Consent not completed. This is expected: a tenant administrator must approve the request. Select Back to login.
6. Ask a Microsoft Entra ID administrator to approve the request in the Azure Portal:
   1. Go to Enterprise applications > Admin consent requests and select the pending request.
   2. Select Review permissions and consent, then sign in with the administrator account.
   3. Confirm Consent on behalf of your organization, then select Accept.
7. Return to Segura® Platform and repeat the Authenticate action. Because consent was granted, Microsoft redirects you back automatically, and Segura® Platform displays Consent completed.
8. Select Back to login, then log in to Segura® Platform again.

Test the configuration

1. In the accounts list, select the Actions button for the authenticated account, then select Test setting.
2. On the Test Email - Account form, enter a destination address in Send to, then select Send.
3. When Segura® Platform displays Test email successfully sent, select Continue.
4. To audit the send, go to Settings > Email > Outbox and confirm the record status is Sent.
5. Check the recipient inbox to confirm the test message arrived.

Related topics

• SMTP configuration.
• Manage SMTP settings.
• Manage IMAP/POP3 settings.