How can we help you?

Why Graph API and not SMTP? Microsoft is gradually disabling Basic Authentication for SMTP, IMAP, and POP in Exchange Online. The Microsoft Graph API is the supported, long-term way to send mail from a Microsoft 365 mailbox.

What you will need

Before you start, make sure you have:

• A Microsoft 365 (or Office 365) subscription that includes Exchange Online — for example Business Basic, Business Standard, E1, E3, F3, or any plan that gives you mailboxes.
• Administrator access to your Microsoft Entra ID (formerly Azure Active Directory). Only an administrator can create an app registration and grant the permission required to send mail.
• A mailbox to send from — typically a shared mailbox like noreply@yourcompany.com or a regular user mailbox. The mailbox does not need a password — Microsoft Graph uses the application credentials, not a user login.
• Windows PowerShell with the ExchangeOnlineManagement module — used once, during setup, to restrict which mailboxes the application is allowed to send from. (Installation instructions are included below.)
• About 20 minutes end-to-end.

Part 1 — Register an application in Microsoft Entra ID

The application registration is how Microsoft 365 will recognise and authorise ParkFlow to send mail on your behalf.

1.1 Create the app registration

1. Go to https://portal.azure.com and sign in as an administrator.
2. Open Microsoft Entra ID (use the search bar at the top if you can't see it).
3. In the left menu, select App registrations, then click + New registration.
4. Fill in the form:
   • Name: ParkFlow Mail (or anything else — only you will see it).
   • Supported account types: Accounts in this organizational directory only (single tenant).
   • Redirect URI: leave empty — ParkFlow does not need it for this flow.
5. Click Register.

You will be taken to the application overview page.

1.2 Copy the IDs

On the overview page, copy and save these two values — you will paste them into ParkFlow later:

• Application (client) ID
• Directory (tenant) ID

1.3 Grant the Mail.Send permission

1. In the left menu of the app, click API permissions.
2. Click + Add a permission.
3. Select Microsoft Graph.
4. Select Application permissions (not Delegated).
5. Search for Mail.Send, tick the box, then click Add permissions.
6. Back on the API permissions page, click Grant admin consent for <your organisation> and confirm.

The Status column for Mail.Send should now show a green tick.

Optional cleanup: If the list contains a default User.Read permission added automatically by Azure, you can remove it — Mail.Send is the only permission ParkFlow needs.

1.4 Create a client secret

1. In the left menu, click Certificates & secrets.
2. Under Client secrets, click + New client secret.
3. Give it a description (e.g. ParkFlow Mail) and choose an expiry (12–24 months is typical).
4. Click Add.
5. Immediately copy the secret's Value. Once you leave this page, the value is hidden forever.

You should now have three values written down:

• Directory (tenant) ID
• Application (client) ID
• Client secret value

Keep these confidential — anyone who has all three can send mail on your tenant's behalf.

Part 2 — Restrict which mailboxes the app can use

Read this section carefully. The Mail.Send permission, by default, lets the application send mail as any user in your organisation. You should restrict it to only the mailbox(es) you intend ParkFlow to use. Microsoft recommends this step explicitly — skip it and a leaked client secret could be used to send mail from any user's address.

You restrict access with the Application Access Policy PowerShell cmdlet, which takes about a minute.

2.1 Install the Exchange Online PowerShell module (once)

Open Windows PowerShell as Administrator and run:

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

Accept any prompts about the PSGallery repository.

2.2 Sign in to Exchange Online

Connect-ExchangeOnline -UserPrincipalName admin@yourcompany.com

Replace the address with your Microsoft 365 administrator account. A browser window will open for sign-in.

2.3 Create the access policy

Replace the two highlighted values with your own:

• <APPLICATION_CLIENT_ID> — the Application (client) ID from step 1.2.
• noreply@yourcompany.com — the mailbox ParkFlow will send from.

``powershell New-ApplicationAccessPolicy -AppId "" -PolicyScopeGroupId "noreply@yourcompany.com"