Configure Outlook OAuth Authentication

This guide explains how to authenticate a Microsoft Outlook email account with Frappe using OAuth. After completing the setup, Frappe can securely send and receive emails without storing your Microsoft account password.

Important:

The user authorizing the Outlook account must be logged into Frappe using the same email address that will be configured as the Email Account.

Step 1: Create a Connected App in Frappe

Create a new Connected App.
Enter a name and save the document.
Copy the generated Redirect URI for later use.

The Redirect URI will be required while registering the application in Microsoft Azure.

Step 2: Register an Application in Microsoft Azure

Sign in to the Microsoft Azure Portal.
Open Microsoft Entra ID.
Select Add → App Registration.

While creating the application:

Enter an application name.
Select the appropriate supported account type.
Choose Web as the platform.
Paste the Redirect URI copied from Frappe.

Complete the registration to create the application.

Step 3: Copy the Client ID

After registration, copy the application’s Application (Client) ID.

Paste this value into the Client ID field of your Connected App in Frappe.

Step 4: Configure Microsoft Graph Permissions

Open the API Permissions section of the registered application.

Add the following Delegated Permissions:

IMAP.AccessAsUserAll
SMTP.Send
offline_access

Save the permissions after adding them.

Step 5: Create a Client Secret

Open Certificates & Secrets.
Create a new Client Secret.
Add a description.
Generate the secret.

Copy the generated Secret Value and paste it into the Client Secret field of your Connected App in Frappe.

Note:

The secret value is displayed only once. Store it securely before leaving the page.

Step 6: Configure OpenID Connect

Open the application’s Endpoints page and copy the OpenID Connect Metadata Document URL.

In your Frappe Connected App:

Paste the URL into the OpenID Configuration field.
Click Get OpenID Configuration.
Save the populated endpoint information.

Add the following OAuth scopes:

https://outlook.office.com/IMAP.AccessAsUser.All

https://outlook.office.com/SMTP.Send

offline_access

Step 7: Authorize the Connected App

Click the Connect to <Connected App> button in Frappe to begin the OAuth authorization process.

Best Practice:

Use the same Outlook email address during OAuth authorization that you plan to configure in the Email Account document.

Step 8: Verify the Token Cache

After successful authorization, you are redirected back to the Connected App.

Open the generated Token Cache and verify that it contains:

Access Token
Refresh Token

Both tokens are required for uninterrupted OAuth authentication.

Step 9: Configure the Email Account

Create a new Email Account and configure it as follows:

Select OAuth as the authentication method.
Select the Connected App you created.
Select the user who authorized the Connected App.
Complete the remaining Email Account configuration.

Save the Email Account after completing the setup.

Additional Requirements

Ensure that your Microsoft account allows IMAP or POP connections before attempting to send or receive emails through Frappe.

Tip:

Microsoft only allows sending emails from the account that completed the OAuth authorization. If required, configure the available Email Account options to match this behavior.

Service Principal Authentication

Frappe also supports authentication using a Service Principal, allowing applications to access Exchange Online without requiring individual users to have Full Access permissions on a shared mailbox.

This method is particularly useful when using shared mailboxes dedicated to automated email processing.

To use this authentication method, enable the Service Principal Authentication option in the Email Account document.

Rating: 0 / 5 (0 votes)