11.5. IMAP OAuth2 and SharePoint Online credentials

Microsoft 365 and Google no longer accept mailbox passwords from applications: access is granted with OAuth 2.0, a one-time authorization in the browser that gives ChronoScan a token it renews by itself. The two buttons of the System panel (Administration tab) manage those credentials for the whole installation.

IMAP OAuth2 Credentials

Used by the IMAP mailboxes read by ChronoScan Enterprise. The mailbox account is first created in the web client (Job settings, IMAP input, with the OAuth2 provider Office 365 or Gmail); then, on a desktop station connected to Enterprise and signed in as an administrator:

Open IMAP OAuth2 Credentials, select the account and click Get credentials. The browser opens to sign in with the mailbox and accept the permissions; you have ten minutes to complete it.
Click Test credentials. The Credentials column should read "Credentials obtained".
Back in the web client, click Check connection on the account.

The token renews itself before it expires. With your own Microsoft 365 app registration the client secret expires: the list warns "Credentials expire on" thirty days before and "Credentials expired" afterwards; note the date when you set it up. If the log shows "Error refreshing token", run Get credentials again. Tenant policies such as conditional access or MFA can invalidate the authorization: use a service mailbox.

SharePoint Online Connections

Saved connections to SharePoint Online used by the SharePoint export module (upload to a library with metadata columns) and by hot folders and imports that take documents from a library. Each connection has a name, the address of the SharePoint site, retries on error and the credentials type:

User and password: for on-premise SharePoint servers (user, password, domain).
OAuth2: for SharePoint Online, with ChronoScan's app registration or your own in your tenant (option "Use app registration in my tenant", with the expiry date of the secret). Get credentials opens the browser to authorize; the list shows "Credentials obtained" and the date.

This utility requires .NET Framework 4.5 or later. Credentials and tokens are stored encrypted in the configuration folder (OAuth and SharePointConn) for the machine and user that obtained them; see Where data and credentials are stored and Using Microsoft 365 Accounts (OAuth2) for Email and SharePoint Integration.