Set up an Outlook app registration

Configure an app-only Outlook connection for unattended mailbox automation.

Use an app registration when a workflow needs app-only mailbox access. No user signs in. This is useful for shared or service mailboxes and the On Email Received trigger.

Before you begin

Create a Microsoft Entra app registration. Create a client secret. Copy its Client ID, Tenant ID, and Client Secret.

For app-only access, configure Application permissions. Do not use delegated permissions.

1

Add Microsoft Graph permissions

In your Microsoft Entra app registration, go to API permissions → Add a permission → Microsoft Graph → Application permissions.

Add the permissions required by your workflow:

Permission	Type	Purpose
Mail.Send	Application	Send emails as any user.
Mail.Read	Application	Read emails for the Search Emails action.
Mail.ReadBasic.All	Application	Required for the On Email Received trigger.
Mail.ReadWrite	Application	Create drafts, add attachments, modify messages, and reply or forward.
MailboxSettings.Read	Application	Get the list of email categories.
Calendars.ReadWrite	Application	Read calendars and create events.
User.Read.All	Application	Read user profiles. Optional.

Grant admin consent for your tenant after adding permissions.

2

Create a mailbox boundary

By default, app-only permissions grant access to all tenant mailboxes. Complete this step and the next one to limit access.

1. In the Microsoft 365 Admin Center, go to Teams & groups → Shared mailboxes.

2. Create the shared mailbox for the workflow.

3. Go to Active teams & groups → Mail-enabled security.

4. Create a mail-enabled security group, such as StackAI-Authorized-Mailboxes.

5. Add the shared mailbox to that group.

3

Restrict mailbox access

An administrator must complete these steps in PowerShell.

1. Connect to Exchange Online.

   Connect-ExchangeOnline

2. Create the access policy. Replace the values with your app's client ID and security-group email.

   New-ApplicationAccessPolicy -AppId "YOUR_CLIENT_ID" `
       -PolicyScopeGroupId "[e-mail]" `
       -AccessRight RestrictAccess `
       -Description "Allow Stack AI to access authorized mailboxes only."

3. Wait 15 minutes. Then verify access.

   Test-ApplicationAccessPolicy -Identity "[e-mail]" -AppId "YOUR_CLIENT_ID"

The command must return AccessCheckResult: Granted.

4

Create the StackAI connection

1. Create an Outlook (App Registration) connection.

2. Enter the Client ID, Client Secret, and Tenant ID.

3. Enter the shared mailbox address as the User Principal Name.

4. For On Email Received, select this connection and set Folder to Inbox.

A 403 Forbidden error can mean admin consent is missing. It can also mean the access policy has not synced. Exchange changes can take 30–60 minutes.

A 404 Not Found error can mean the User Principal Name is incorrect. Run Get-User -Identity "email" to confirm the exact UPN.