> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.supersend.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Azure app registration and Microsoft service account (Outlook)

# Azure app registration and Microsoft service account (Outlook)

## Purpose

This article is for **Microsoft 365 / Azure AD administrators** who connect Outlook mailboxes in SuperSend using a **Microsoft service account** (application permissions and client credentials), instead of per-user OAuth. You will learn what SuperSend expects in Azure and where to enter credentials in the app.

## Prerequisites

- **Azure AD role** that can create app registrations and grant admin consent (e.g. Global Administrator or Privileged Role Administrator with App Registration permissions—your org’s requirements may vary).
- A clear **reason to use service account** vs OAuth: service accounts use **application** permissions so mailboxes can be connected without each user signing in through Microsoft’s consent screen (typical for many mailboxes on one tenant).
- For **manual** setup: access to [Azure Portal](https://portal.azure.com) for your tenant.

## What SuperSend stores

A **Microsoft service account** in SuperSend is team-scoped credentials:

- **Application (client) ID**
- **Directory (tenant) ID**
- **Client secret** (the secret *value*, not the secret ID)

These are used to obtain Microsoft Graph tokens for sending and mailbox access for Outlook senders linked to that service account.

## Required Azure app registration (manual setup)

Create or edit an **App registration** in Azure Portal (**Microsoft Entra ID** → **App registrations** → **New registration**).

1. **Name** — any name your admins will recognize (e.g. `SuperSend Outlook`).
2. **Supported account types** — typically **Accounts in this organizational directory only** (single tenant), matching your tenant.
3. **Redirect URI** — not required for the **service account** (client credentials) path. You can leave it empty for this use case.

### API permissions (Microsoft Graph)

Add permissions under **Microsoft Graph** → **Application permissions** (not delegated):

| Permission        | Purpose |
|-------------------|--------|
| **User.Read.All** | Lets SuperSend resolve the mailbox user when connecting a sender (Graph `GET /users/{email}`). Without this, connection can fail with a generic “Failed to get Outlook profile” error. |
| **Mail.Read**     | Read mail (inbox/replies) via Graph. |
| **Mail.ReadWrite**| Read and update mail folders and messages. |
| **Mail.Send**     | Send mail via Graph. |

Then click **Grant admin consent for [your organization]**. Application permissions do not apply until admin consent is granted.

### Client secret

1. Open **Certificates & secrets** → **New client secret**.
2. Choose an expiry your security policy allows (many teams use 12–24 months).
3. Copy the **Value** immediately (shown once). Paste that into SuperSend as **Client Secret**.

### No Exchange “ApplicationImpersonation” in the portal checklist

SuperSend’s documented Graph setup focuses on **Graph application permissions** and consent. If your tenant uses additional Exchange Online policies, work with your IT team—some orgs restrict application access to mailboxes until mailbox or tenant policies allow it.

## Where to enter credentials in SuperSend

### Option A — Organization Admin (Integrations)

For teams that centralize credentials:

1. Go to **Organization Admin** → **Admin Settings** (`/org/admin`).
2. Open the **Integrations** tab.
3. Select the **team** your senders belong to.
4. Open the **Microsoft** integration. The **Microsoft service account** panel lets you **create**, **edit**, and **delete** service accounts and mark one as **default** for the team.

### Option B — Add Sender wizard (inline)

When adding an Outlook mailbox:

1. Go to **Senders** → **Add Sender** → **Email Sender** → **Connect Your Own Mailboxes** → **Microsoft Outlook**.
2. Select the **Service Account** tab (next to **OAuth**).
3. Choose an existing service account, or use **Create Service Account** / **Create New Service Account** and enter **Name**, **Client ID**, **Client Secret**, and **Tenant ID**.
4. Enter the mailbox **email address** and complete the flow.

## Troubleshooting

- **Issue:** “Failed to get Outlook profile” when connecting via service account.  
  **Fix:** In Azure, under **Application** permissions, add **User.Read.All**, then **Grant admin consent**. Confirm the mailbox address matches the user’s **User principal name** in Entra ID if your tenant uses a different UPN than the email alias.

- **Issue:** Service account shows **Active** but senders fail or mail actions fail with permission errors.  
  **Fix:** Re-check that all four **application** permissions are present, **admin consent** shows green checkmarks, and the client secret has **not expired**. Rotate the secret in Azure and update it in SuperSend.

- **Issue:** OAuth works for one user but you need many mailboxes without individual sign-in.  
  **Fix:** Use **Service Account** with application permissions as described above; OAuth in the wizard is a different integration path.

- **Issue:** You cannot see **Organization Admin** → **Integrations**.  
  **Fix:** Only **organization administrators** can open org-level Admin Settings. Ask an org admin to add the Microsoft service account, or use the **Add Sender** flow if your role allows creating service accounts there.

## Related articles

- [Connect Outlook / Microsoft Sender](https://help.supersend.io/en/article/connect-outlook-microsoft-sender-1nh9x39/)
- [Connect Mission Inbox Senders](https://help.supersend.io/en/article/connect-mission-inbox-senders-i03wap/)
- [Senders Overview](https://help.supersend.io/en/article/senders-overview-vqg87v/)