7.5.7. Using Microsoft 365 Accounts (OAuth2) for Email and SharePoint Integration

ChronoScan integrates with Microsoft 365 in three places: sending e-mail with the SMTP Destination Export Module (or ChronoApp.SendSmtpEmail from a script), reading mailboxes with the IMAP input of ChronoScan Enterprise, and exporting documents to SharePoint Online with the SharePoint Destination Export Module.

Microsoft has retired basic authentication (user name and password) for IMAP and SharePoint Online, and multi-factor authentication is enforced by the security defaults of the tenant. Do not disable the security defaults or MFA: ChronoScan authenticates with OAuth2 instead.

Create the mailbox account in the Enterprise web administration, then obtain its credentials from ChronoScan desktop connected to Enterprise and signed in as an administrator: Administration tab, System panel, IMAP OAuth2 Credentials. Select the account and click Get credentials; the browser opens to sign in with the mailbox and accept the permissions (you have 10 minutes). Click Test credentials: the Credentials column must read Credentials obtained. Back in the web, click Check connection.

You can use the ChronoScan app registration or your own Microsoft 365 app registration; with your own, the client secret expires and the list warns 30 days before. The token renews itself; if the log shows Error refreshing token, run Get credentials again. Tenant policies such as conditional access can invalidate the authorization, so use a service mailbox. Details: IMAP Office 365: configure OAuth2 using your own app registration.

Create the connection in the Administration tab, System panel, SharePoint Online Connections, and sign in with OAuth2. The SharePoint export module then uses that connection instead of a user name and password. Classic user/password connections are only for on-premises SharePoint servers.

For sending e-mail through Microsoft 365 use the SMTP settings of your tenant with the authentication method it allows (modern authentication or an app password for the service account), or send through your own SMTP relay. Gmail accounts require an app password as well: Google removed the "allow less secure apps" option in 2022.