Email (Microsoft Graph) Connection

The Outlook Email / Microsoft Graph connection type allows automations to send and read emails through the Microsoft Graph API instead of SMTP. This is the preferred approach for Microsoft 365 environments where SMTP AUTH may be disabled or where richer mailbox operations (reading, moving, replying) are needed.

Connection Type

Property	Value
Type enum	OUTLOOK_EMAIL
Type ID	outlook-email
Category	Communication
Entity class	OutlookEmailConnectionDetails

Friendly Example

What you enter	Example
Connection name	Microsoft Graph Mail - Notifications
Used for	Sending emails from a Microsoft 365 mailbox
Main details to collect	Tenant ID, client ID, client secret, and mailbox address
Best person to provide it	Microsoft 365 administrator

After it is saved, workflow builders select Microsoft Graph Mail - Notifications in a node instead of entering these details again.

Mandatory Fields

Field	Type	Required	Description
tenantId	String	Yes	Azure AD tenant ID (a GUID). Found in Azure Portal under Azure Active Directory > Overview.
clientId	String	Yes	Application (client) ID of the registered Azure AD app.
clientSecret	String	Yes	Client secret value generated for the app registration. Encrypted at rest.
userName	String	Yes	User principal name of the mailbox to send from (e.g., automation@contoso.com). Used to identify the mailbox when sending via the /users/\{userName\}/sendMail Graph endpoint.

Advanced Fields

Field	Type	Required	Description
password	String	No	User password. Only required if using Resource Owner Password Credentials (ROPC) grant type instead of client credentials. Encrypted at rest.
graphBaseUrl	String	No	Override the Graph API base URL. Defaults to https://graph.microsoft.com/v1.0. Use https://graph.microsoft.us/v1.0 for GCC High.

Azure AD App Registration

Follow these steps to create the required Azure AD application:

1. Navigate to Azure Portal > Azure Active Directory > App registrations > New registration.

2. Name the application (e.g., Qinfinite Automation - Email).

3. Supported account types: Select "Accounts in this organizational directory only" for single-tenant use.

4. Register the application. Copy the Application (client) ID and Directory (tenant) ID.

5. Create a client secret:

   • Go to Certificates & secrets > New client secret.
   • Set an appropriate expiration period.
   • Copy the secret Value immediately (it is shown only once).

6. Configure API permissions:

   • Go to API permissions > Add a permission > Microsoft Graph.
   • Add the following Application permissions:

Permission	Purpose
Mail.Send	Send emails on behalf of any user in the tenant
Mail.ReadWrite	Read, create, and update mail in user mailboxes
User.Read.All	Resolve user principal names (optional, for user lookup)

7. Grant admin consent for the permissions by clicking Grant admin consent for [tenant].

caution

Application permissions allow the app to access all mailboxes in the tenant. To restrict access to specific mailboxes, configure an Application Access Policy using Exchange Online PowerShell.

Authentication Flow

The connector uses the OAuth 2.0 Client Credentials flow by default:

1. The connector requests a token from https://login.microsoftonline.com/\{tenantId\}/oauth2/v2.0/token using the clientId and clientSecret.
2. The token is scoped to https://graph.microsoft.com/.default.
3. The connector calls Graph API endpoints (e.g., POST /users/\{userName\}/sendMail) with the Bearer token.

If the password field is provided, the connector can alternatively use the Resource Owner Password Credentials (ROPC) grant, though this is not recommended for production use as it does not support MFA.

Troubleshooting

Symptom	Likely Cause
AADSTS7000215: Invalid client secret	The client secret has expired or was copied incorrectly
AADSTS700016: Application not found	The clientId does not exist in the specified tenant
403 Forbidden on /sendMail	Mail.Send permission not granted, or admin consent not provided
ErrorItemNotFound for the user	The userName does not match a valid mailbox in the tenant