Skip to main content

Email Settings

The Email Settings page configures the Microsoft Graph API credentials that Beak M365 License Optimizer uses to send procurement approval emails. Email is delivered through Microsoft Graph from a sender mailbox you nominate in your own tenant, so deliverability and audit follow your existing Microsoft 365 policies and do not depend on a third-party SMTP relay.

The configuration is split into three sections: Azure AD App Registration, Mailbox Settings, and Approval Routing.

Azure AD App Registration​

Provide the Azure AD app registration that the platform will authenticate as when sending mail through Microsoft Graph.

  • Azure Tenant ID — The directory ID (GUID) of the Microsoft 365 tenant that owns the app registration and the sender mailbox. Required.
  • Client ID — The Application (client) ID of the app registration. Required.
  • Client Secret — A client secret generated for the app registration. Stored encrypted at rest. Required.

The app registration must be granted the Microsoft Graph application permissions required to send mail on behalf of the sender mailbox, with admin consent applied. Without admin consent on the necessary scopes, saving the configuration succeeds but every email send will fail with a permission error visible in the procurement workflow logs.

Note: When the client secret is rotated in Azure, update the Client Secret field here within the rotation window. The platform does not auto-renew the secret.

Mailbox Settings​

Mailbox Settings nominate the mailbox the email is sent from.

  • Sender Mailbox (email) — The address recipients see as the sender (e.g., noreply@yourdomain.com). May be a shared mailbox or a user mailbox in the same tenant as the app registration. Required.
  • Sender Display Name — The friendly From-name shown in the recipient's inbox (e.g., BEAK M365 Governance). Optional; the address is used alone if the display name is left blank.

Approval Routing​

Approval Routing controls where procurement approval requests are sent when no per-workflow approver has been configured.

  • Approver Email — The default recipient that receives procurement approval requests when a request does not specify its own approver. Optional, but procurement workflows depend on either this default or a per-request approver being set.

Saving the Configuration​

Use Save Configuration to persist the settings. The client secret is re-encrypted on save. After saving, submit a low-stakes procurement request to verify end-to-end delivery before relying on the email channel for production approvals.

Note: All three sections are saved together — partial updates require re-entering the client secret because the stored value is encrypted and never returned to the form.

What Uses This Configuration​

Once configured, the email channel is used by procurement approval workflows. Procurement requests submitted on the Procurement page are routed to the configured approver — either the per-request approver if one is set, or the Approver Email value here as a fallback.

Common Failure Causes​

When email delivery fails, the most common root causes are:

  • Expired or rotated client secret — Update the Client Secret field with a fresh secret generated in Azure
  • Missing or revoked admin consent — Grant admin consent on the Microsoft Graph permissions required to send mail as the sender mailbox
  • Sender mailbox does not exist in this tenant — The sender mailbox must live in the same Azure AD tenant as the app registration
  • Wrong Azure Tenant ID — Confirm the directory ID in the Azure AD properties blade matches the value entered here

Best Practices​

  • Use a dedicated service mailbox — Configure a service account mailbox (for example, noreply@yourdomain.com) rather than a personal mailbox; this isolates audit, simplifies offboarding, and keeps approval emails consistent
  • Set an Approver Email as a safety net — A default approver ensures procurement requests do not stall when a workflow-level approver is unset
  • Rotate the client secret on a schedule — Align secret rotation with your tenant's standard cadence and update Email Settings immediately after rotating in Azure
  • Send a test approval after every credential change — Submit a low-stakes procurement request as a smoke test after editing any field, rather than waiting for a real request to fail
  • Restrict access — The credentials stored here grant the platform mail-send rights in your tenant; limit who can view or edit this page through role permissions