In order to set up Application Workspace to work with a Microsoft Graph mail server, you'll first need to complete some tasks within the Microsoft Azure portal:
- Create the Entra ID App Registration to be used with Application Workspace
- Add client secret
- Grant the application API permissions
With Entra ID configuration done, you can then create the mail server in the Application Workspace interface.
Create the Entra ID App Registration for Application Workspace
To create the app registration:
1. Log into https://portal.azure.com using your Azure credentials with full admin rights.
2. Search for App registrations.
3. On the App registrations page, click New registration.
4. Give the application a meaningful display Name. You can change the name later.
5. As the Supported account type, select Single tenant only - <tenant>.
6. As the Redirect URI, select 'Web' and enter the FQDN of the Application Workspace zone you want to add, with the /api/auth/token/end suffix.
Example: https://< Virtual Host >/api/auth/token/end
7. Click Register to complete the initial app registration.
8. In the Overview pane that opens, copy the Application (client) ID and Directory (tenant) ID. You'll need to enter these later to create the Entra ID identity source in Application Workspace.
Add Client Secret
Next, you'll need to generate a client secret that facilitates communication between Application Workspace and Microsoft Entra ID.
To generate a client secret:
1. On the App registrations page, under Manage, click Certificates & secrets.
2. On the Client secrets tab, add a New client secret.
3. Add a client secret Description, choose when the secret Expires, and click Add.
DO NOT navigate away from the page before completing the next step!
4. Copy the client secret value to a clipboard and save it to a secure location. You will not be able to see the client secret after navigating away from the page.
Add API Permissions for Application Workspace
Next, you need to add permissions to your app registration.
To add API permissions:
1. On the App registrations page, under Manage, click API Permissions.
2. Select Add a permission.
3. Select APIs my organization uses, then search for and select Microsoft Graph.
4. Select Application permissions.
5. Search for mail.send and select Add permissions.
6. Click Grant admin consent for <Tenant Name>. It can take up to an hour before these settings take effect in Entra ID.
Create the Mail Server in Application Workspace
To configure Microsoft Graph mail server settings in Application Workspace:
1. In the Application Workspace interface, navigate to Manage > System > Mail Settings.
2. Click Create.
3. In the Create mail server window that opens, enter or select the following options:
- Type: Microsoft Graph.
- Overview: Enter the desired name, description and priority. Click Next.
- Settings:
- Enter the client ID and tenant ID of the application you previously registered. You can find them on the Overview tab within Microsoft Entra ID.
- Enter the client secret you generated earlier.
- Enter the From mail address used to send the emails.
4. Review the Summary and click Finish.
