MailCalm Azure Permissions Guide

MailCalm connects to Microsoft 365 through an app registration in Microsoft Entra.

This setup only needs to be completed once for your organisation.

What you will need

You will need:

• Access to Microsoft Entra
• Permission to create an app registration
• Permission to grant admin consent
• Access to the mailbox MailCalm will manage
• Send As permission if MailCalm will manage a shared mailbox

1. Open Microsoft Entra

Open Microsoft Entra and sign in with an administrator account.

In the left-hand menu, open App registrations.

2. Create the MailCalm app registration

1. Click New registration.
2. Enter MailCalm as the name.
3. Under Supported account types, choose the single-tenant option.
4. Leave Redirect URI blank.
5. Click Register.

3. Copy the application details

On the app registration Overview page, copy:

• Application (client) ID
• Directory (tenant) ID

Both values look similar to:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Keep this page open. You will paste both IDs into the MailCalm setup wizard.

Do not copy the Object ID. MailCalm needs the Application ID and Directory ID.

4. Add Microsoft Graph permissions

Open API permissions.

Click:

1. Add a permission
2. Microsoft Graph
3. Delegated permissions

Add the following permissions:

• User.Read
• Mail.ReadWrite
• Mail.ReadWrite.Shared
• Mail.Send
• Mail.Send.Shared
• MailboxSettings.ReadWrite

After adding the permissions, click Grant admin consent for MailCalm.

Confirm that the permissions show as granted for your organisation.

5. Enable public client flows

Open Authentication for the MailCalm app registration.

Open the relevant settings area and find:

Allow public client flows

Set it to:

Yes

Save the change.

This allows MailCalm to use Microsoft’s secure device sign-in process.

6. Paste the IDs into MailCalm

Return to the MailCalm setup wizard.

Paste:

• Application (client) ID into the first field
• Directory (tenant) ID into the second field

Click Next.

MailCalm checks that both values use the correct Microsoft ID format.

7. Sign in to Microsoft

On the next wizard page, click Open Microsoft sign-in.

MailCalm will:

1. Show a Microsoft device code.
2. Open Microsoft’s secure sign-in page.
3. Ask you to enter the code.
4. Ask you to sign in with the Microsoft account that will connect MailCalm to the mailbox.

Return to MailCalm after completing the sign-in.

Shared mailbox access

When using a shared mailbox, the Microsoft account used to sign in must already have access to that mailbox.

MailCalm may require the account to have:

• Full Access
• Send As

These permissions are managed in Microsoft 365 Admin Center.

If MailCalm can read the shared mailbox but cannot send from it, grant Send As permission to the signed-in user.

Microsoft permission changes can sometimes take 5–30 minutes to apply.

After changing mailbox permissions, sign in again and retry setup.

Common problems

The Application ID or Tenant ID is rejected

Make sure you copied:

• Application (client) ID
• Directory (tenant) ID

Do not use the Object ID.

Microsoft sign-in does not open

Check that:

• Allow public client flows is set to Yes
• the Application ID is correct
• the Tenant ID is correct
• the app registration belongs to the same organisation as the account signing in

MailCalm cannot access the shared mailbox

Check that the signed-in user has access to the shared mailbox in Microsoft 365.

MailCalm can read but cannot send

Grant the signed-in user Send As permission for the shared mailbox.

Wait for Microsoft to apply the change, then sign in again.

Admin consent has not been granted

Return to API permissions in Microsoft Entra and click Grant admin consent for MailCalm.

Security notes

MailCalm uses Microsoft’s secure sign-in process.

Customers do not enter their Microsoft password directly into MailCalm.

The app registration is created inside the customer’s own Microsoft tenant, and access remains controlled through Microsoft Entra and Microsoft 365 permissions.