Configure OAuth2.0 authentication for SMTP and IMAP via Azure

Segura® Platform authenticates Microsoft-hosted SMTP and IMAP mail accounts with OAuth2.0 through a native Authenticate flow. This flow replaces the email-oauth2-proxy component for Microsoft accounts and works in multi-tenant environments.

This document covers the Azure setup, the credential, and the SMTP account. The Azure application and credential you create here also authenticate IMAP. To configure the IMAP account itself, see Manage IMAP/POP3 settings.

Requirements

• Administrative access to the Microsoft Azure Portal, including rights to grant the requested permissions.
• Administrative access to Segura® Platform.
• The Segura® Platform URL, to register as the Azure redirect URI.

Register an application in Azure

1. Access the Azure Portal and log in to your Azure account.
2. Locate the service Microsoft Entra ID.
3. In the left menu, select Manage > App registrations.
4. Select your existing mail application, or select New registration to create one.
5. In the application's left menu, select Manage > Authentication.
6. Under Web > Redirect URIs, add or update the URI so that it ends with flow/mail/auth/return. Use the following format, and match it exactly, including the scheme:

https://<your-segura-url>/flow/mail/auth/return

7. From the application's Overview page, copy the Application (client) ID and the Directory (tenant) ID. You need both values later.

Generate a client secret

1. In the application's left menu, select Manage > Certificates & secrets.
2. Select New client secret.
3. In the Description field, enter a description for the client secret.
4. In the Expires field, select when the client secret expires.
5. Select Add.

Configure API permissions

1. In the application's left menu, select Manage > API permissions.
2. Select Add a permission, then select Microsoft Graph.
3. Select Delegated permissions.
4. Add the following permissions:
   1. Mail.Send: supports sending through SMTP.
   2. Mail.Read, labeled Read user mail: supports reading through IMAP.
5. Select Add permissions.

Create a credential in PAM Core

1. On Segura®, in the navigation bar, hover over the Products menu and select PAM Core.
2. Go to Credentials > All credentials, and select Add.
3. On the Information tab, complete the following fields:
   1. Username: enter the Application (client) ID you copied earlier.
   2. Device: enter the mail provider's host, for example outlook.office365.com for a Microsoft 365 account, or outlook.live.com for a personal Microsoft account.
   3. Password type: select Local user.
   4. Additional information: enter the Directory (tenant) ID you copied earlier.
   5. Password: enter the client secret value you copied earlier.
4. Select Save.

Configure the SMTP account

1. On Segura®, in the navigation bar, hover over the Products menu and select Settings.
2. On the side menu, select Email > SMTP configuration. For the general account fields not covered here, such as account name, sender email, and reply email, see Manage SMTP settings.
3. Add a new account, or edit an existing one, for the Microsoft mailbox.
4. Complete the following fields:
   1. Host SMTP: enter the provider's host, for example smtp.office365.com.
   2. Port: enter 587.
   3. Use safe connection?: select No.
   4. Ignore certificate error: select Yes.
   5. Enable footnote: select No.
5. In the Use authentication? field, select Yes.
6. In the Credential for authentication field, select the credential you created in Create a credential in PAM Core.
7. Select Send.

Authenticate with Microsoft

1. In the accounts list, select the Actions button for the account, then select Authenticate.
2. Segura® Platform displays a message: it will redirect you to Microsoft for authentication, and you will need to log in to Segura® Platform again afterward. Select Yes to continue.
3. Log in to the Microsoft account associated with the mailbox.
4. On the permissions screen, accept the requested access.
5. Segura® Platform displays Success - Authenticated successfully.
6. Select Back to login.
7. Log in to Segura® Platform again to continue.
8. In the accounts list, select the Actions button for the authenticated account, then select Test setting.
9. Enter a destination address and send a test message.

Related topics

• Manage SMTP settings.
• Manage IMAP/POP3 settings.