PingOne Advanced Identity Cloud

Configure a Microsoft Azure tenant for the Microsoft Graph email provider

The Microsoft Graph email provider requires a properly configured Microsoft Azure tenant. The steps for configuring an Azure tenant should be used as an outline, as the specific options, menus, and features may have changed.

Microsoft Sandbox

If you need a sandbox for testing only, check out the Microsoft developer sandbox subscription. Although the sandbox accepts sendMail requests, the Microsoft Exchange service prevents messages from being delivered. The messages do show up in the sender’s "sent" box, which should be sufficient for manual testing purposes.

  1. Go to Microsoft Entra ID | App registrations.

  2. Create the Advanced Identity Cloud client application:

    1. From the menu bar, click + New Registration.

    2. On the Register an application page, enter the application Name, such as my-email-client.

    3. For Supported account types, select the applicable option for your organization.

    4. Click Register.

    5. On the my-email-client page, from the main Essentials area, record the Application (client) ID.

    Use this value for the Client ID field in the admin console, or the clientId property in the REST API. Learn more in oauth2 properties.

  3. Create a client secret:

    1. On the my-email-client page, in the main Essentials area, click Add a certificate or secret.

      Show Me
      Azure app - add a secret link

    2. On the Certificates & secrets page, select the Client secrets tab, and click + New client secret.

      Show Me
      Azure app - add a new client secret

    3. In the Add a client secret window, enter the details, and click Add.

    4. Copy the Value and Secret ID to a secure place before leaving the Certificates & secrets page.

    Use the secret Value (not the Secret ID) for the Client Secret Identifier field in the admin console, or the clientSecret property in the REST API. Learn more in oauth2 properties.

  4. Request API permissions:

    1. From the side menu, click API permissions.

    2. On the API permissions page, click + Add a permission.

    3. In the Request API permissions windows, select the Microsoft APIs tab, and click Microsoft Graph.

    4. In the What type of permissions…​ area, click Application permissions.

    5. In the Select permissions search bar, type send.

    6. Expand the Mail node, and select Mail.Send.

    7. Click Add permissions.

      Show Me
      Azure app - Request API permissions

  5. Grant admin consent:

    1. On the API permissions page, click Grant admin consent for <Your Tenant>.

    2. Click Yes to confirm.

    3. Verify that the Status column for Mail.Send displays a green checkmark indicating consent is granted.