Connect Outlook and Microsoft 365

Your server can read your Outlook mail and calendar. It signs in through an app that you make in Microsoft Entra. Who can make that app depends on your account.

#Pick your way

A sign-in app is a small setup in Entra. Entra calls it an app registration.

There is no way in with a password. Outlook.com and Microsoft 365 no longer let other mail apps sign in with one. So IMAP and SMTP cannot reach them.

#Why a work account needs an admin

Microsoft sets a default rule for work and school accounts. Staff may not approve an app that reads mail or calendars. It does not matter who made the app. Only an admin can approve it. One approval covers all staff. Your workplace may also have its own rule.

The admin needs one of these roles:

• Global Administrator
• Privileged Role Administrator
• Cloud Application Administrator
• Application Administrator

Is the Grant admin consent button greyed out for you? Then you do not hold one of these roles. That is your workplace's rule, not a fault in Recued. Send this page to someone who holds one.

#Where to connect from

Microsoft is strict about the callback address. Three of your addresses work:

• app.recued.com.
• Your server's own HTTPS address. That is your Pro address, https://<handle>.recued.net, or your own domain.
• The server's own address, http://localhost:7717/webclient.

These do not:

• A LAN address, or a bare IP address such as https://192.168.1.20. Its callback names the page after a ?. Microsoft does not allow that for an app that takes personal accounts.
• http://127.0.0.1. The Azure portal refuses an http callback at a number. Use localhost instead. It is the same server, by name.

Each address has its own callback. Recued shows the right one on the form. Do you connect from more than one address? Then add each callback to the app.

To open Recued at your HTTPS address, open Settings, then Server, then Exposure. Under Exposure & serving, tick Public on the /webclient row. Then go to /webclient at that address.

Or open Recued on the server at http://localhost:7717/webclient. Is this address new to your browser? Then pair it once, like a new device. Does your server have no screen? Make a tunnel from your own computer:

ssh -L 7717:127.0.0.1:7717 you@your-server

Then open http://localhost:7717/webclient on your computer. You only connect once. After that, the account keeps working from any address.

#Make the app

Whoever makes the app follows these steps. For a work account, that is the admin. With your own account, you need an Entra directory first. Sign up for a free Azure account, and you get one.

1. Open the Azure portal. Go to Microsoft Entra ID, then App registrations, then New registration.
2. Under Supported account types, choose Accounts in any organizational directory and personal Microsoft accounts.
3. Under Redirect URI, pick Web. Paste the callback URL that Recued shows. It is on the Microsoft form under Connections. Then choose Register.
4. Open API permissions. Choose Add a permission, then Microsoft Graph, then Delegated permissions.
5. Add Mail.Read, offline_access and User.Read. Add Mail.Send if Recued should send mail. Add Calendars.ReadWrite for your calendar.
6. Open Certificates & secrets. Make a new client secret. Copy its Value right away. Azure shows it only once.
7. Copy the Application (client) ID from the Overview page.

Recued signs in through one shared address at Microsoft. So the other account types fail. A personal account cannot use an app made for work accounts only. No one can use an app made for just one workplace.

Leave out offline_access, and Recued cannot renew its sign-in. Syncing would then stop about an hour after you connect.

#Approve it for all staff

This step is for a work or school account. The admin opens API permissions on the app. There they choose Grant admin consent.

Without it, sign-in stops at "Need admin approval". Some workplaces show "Approval required" instead. Send the request it offers. Then connect again once an admin says yes.

#Share it with your staff

A workplace needs only one app. All staff connect with the same Client ID and secret. Each person pastes them into the Microsoft form in Recued.

The callback is the same for all of them too. The one on app.recued.com never changes. On localhost, Microsoft ignores the port.

The secret names the app, not a person. It opens no mailbox by itself. Each person still signs in with their own account. They only reach their own mail.

#Related

• Connections. How a saved connection works.
• Connect Gmail and Google Calendar. The same choices for a Google account.
• Pairing and devices. Pair a browser with your server.