Requirements summary
The following elements must be in place to complete this integration. Each is covered by a step in this guide.
# | Requirement |
1 | A valid, licensed email account (Microsoft 365 mailbox) to send from |
2 | An Entra ID application registration with a client secret (secret key) |
3 | Microsoft Graph API permission — Group.Read.All |
4 | Microsoft Graph API permission — Mail.Send |
5 | Microsoft Graph API permission — User.Read |
6 | Microsoft Graph API permission — User.Read.All |
7 | Admin consent granted for the permissions above |
8 | SMTP AUTH enabled on the sender mailbox (Microsoft 365) |
9 | SafeConsole mail settings configured with the OAuth credentials |
Prerequisites
- A valid, licensed Microsoft 365 mailbox that will act as the sender (the “Send From” address in SafeConsole).
- An Entra ID administrator account (Application Administrator or Global Administrator) able to register apps and grant admin consent.
- Access to the Microsoft 365 / Exchange admin center to enable SMTP AUTH on the sender mailbox.
- SafeConsole Account Owner / Administrator access to change Server Settings.
- Access to the Azure Portal at https://portal.azure.com.
Step 1 — Register the application (Entra ID)
- Sign in to the Azure Portal (portal.azure.com) as an administrator.
- Open Microsoft Entra ID → App registrations → + New registration.
- Enter a Name, for example SafeConsole-SMTP-OAuth.
- For Supported account types, select Accounts in this organizational directory only (single tenant).
- Leave Redirect URI empty, then click Register.
- On the app's Overview page, copy the Application (client) ID and Directory (tenant) ID — both are needed for SafeConsole.
Step 2 — Create the client secret (secret key)
- In the app registration, open Certificates & secrets.
- On Client secrets, click + New client secret.
- Enter a Description (e.g. safeconsole-smtp-secret) and set an Expires period (e.g. 12–24 months).
- Click Add, then immediately copy the secret Value.
Copy the secret immediately The secret Value is displayed only once and cannot be retrieved afterwards. Record it securely now; if lost, you must generate a new secret. Also note the expiry date — email will stop working when the secret expires and a new one must be issued and updated in SafeConsole. |
Step 3 — Add Microsoft Graph API permissions
- In the app registration, open API permissions.
- Click + Add a permission → Microsoft Graph.
- Select the permission type (Application or Delegated as noted below), search for each permission, and add it.
- Repeat until all four permissions below are present, then click Add permissions.
Required Microsoft Graph permissions
Permission | Type | Purpose in the SafeConsole integration |
Mail.Send | Application | Allows SafeConsole's registered app to send email (admin invites, device-connect invitations, notifications) as the sender mailbox. |
Group.Read.All | Application | Read all groups — supports resolving distribution / security groups and (where used) scoping which mailbox may send. |
User.Read.All | Application | Read all user profiles — used to resolve the sender mailbox and recipient user objects. |
User.Read | Delegated | Sign in and read the signed-in user's basic profile (used during interactive OAuth consent / sign-in). |
Application vs Delegated Add Mail.Send, Group.Read.All and User.Read.All as Application permissions (SafeConsole sends unattended, with no signed-in user). User.Read is Delegated and applies to interactive sign-in / consent. Add all four exactly as listed in the requirements. |
Step 4 — Grant admin consent
- On the API permissions page, click Grant admin consent for <tenant>.
- Confirm with Yes.
- Verify every permission shows a green Granted status.
Restrict the sender (recommended) By default the app can act on any mailbox in the tenant. To limit it to only the SafeConsole sender mailbox, create an Application Access Policy in Exchange Online PowerShell (New-ApplicationAccessPolicy) scoped to a mail-enabled security group that contains only the sender account. |
Step 5 — Enable SMTP AUTH on the sender mailbox
Client SMTP submission must be enabled for the sender mailbox, both tenant-wide and per-mailbox, for OAuth SMTP to succeed.
- In the Microsoft 365 Admin Center → Users → Active users, open the sender mailbox.
- Go to Mail → Manage email apps and ensure Authenticated SMTP is enabled.
- In the Exchange Admin Center, confirm SMTP AUTH is not disabled at the organization level.
Step 6 — Configure SafeConsole mail settings
Enter the Microsoft 365 SMTP endpoint and the OAuth credentials from the previous steps into SafeConsole. On newer SafeConsole builds this is available under Server Settings → Mail server settings (or the Configurator's Mail step on On-Prem).
- Log in to SafeConsole as the Account Owner / Administrator.
- Open Server Settings and choose Use custom mail server.
- Enter the SMTP and OAuth values as shown below.
- Set the Send From address to the licensed sender mailbox.
- Use Verify / Send test to send a test email to a recipient you control, then Save.
Values to enter in SafeConsole
Field | Value |
Secure connection | Enabled (STARTTLS / TLS) |
Authentication | OAuth 2.0 (modern authentication) |
Tenant (Directory) ID | From app Overview (Step 1) |
Application (Client) ID | From app Overview (Step 1) |
Client secret | Secret Value from Step 2 |
Username / Send From | The licensed sender mailbox |
Field labels may vary by version Exact field names differ between SafeConsole Cloud and On-Prem and across versions. If OAuth SMTP fields are not present in your build, update SafeConsole to a version that supports modern authentication, or contact DataLocker support to confirm the supported configuration for your release. |
Requirements checklist
Confirm each requirement is complete before handing the integration back to the client.
Requirement | Covered by |
Valid email account (licensed M365 mailbox) | Prerequisites / Step 5 |
Application with secret key | Steps 1 & 2 |
Microsoft Graph API — Group.Read.All | Step 3 |
Microsoft Graph API — Mail.Send | Step 3 |
Microsoft Graph API — User.Read | Step 3 |
Microsoft Graph API — User.Read.All | Step 3 |
Admin consent granted | Step 4 |
SMTP AUTH enabled on mailbox | Step 5 |
SafeConsole mail settings configured | Step 6 |