Skip to content
Foxx Cyberfoxxcyber/docs

Microsoft 365

Register your organization's Entra ID app so people can sign in to Foxx HQ with their Microsoft work account and connect their Outlook mailbox to Mail.

With your organization's own Microsoft Entra ID app registration, people can click Sign in with Microsoft on your sign-in page and use their Microsoft 365 work account instead of a Foxx HQ password.

Microsoft only tells Foxx HQ who signed in. Foxx HQ never creates anyone from it: the person's Microsoft address must belong to an active user in your organization (see Users, departments and teams).

Before you start

  • You must be a company administrator in Foxx HQ.
  • You need someone who can register apps in your Microsoft Entra admin center (often your Microsoft 365 administrator). The Microsoft steps are done once per organization.

Step 1: in Microsoft Entra

Administration → Microsoft 365 lists the exact redirect URI in the In Microsoft Entra card. In the Microsoft Entra admin center:

  1. Open App registrations → New registration. Name it (for example "Foxx HQ") and choose Accounts in this organizational directory only (single tenant).
  2. Under Redirect URI, choose Web and paste the URI the card shows (click Copy). It is your organization's own address, ending in /api/auth/sso/microsoft/callback.
  3. Click Register. From the app's Overview, copy the Directory (tenant) ID and the Application (client) ID.
  4. Open Certificates & secrets → New client secret, and copy the secret's Value (not its ID). Microsoft shows it only once.

Signing in needs no extra API permissions: it uses the standard openid, email and profile permissions. Mail needs a few more, below.

Step 2: in Foxx HQ

  1. In the App registration card, paste the Directory (tenant) ID, the Application (client) ID and the Client secret.
  2. Click Save. The badge changes to configured.
  3. Open Administration → Security and, under Sign-in methods, turn on Sign in with Microsoft. See Sign in with Google or Microsoft.

The secret is never shown again. To change the IDs later, leave the secret blank to keep the stored one. When the secret expires in Microsoft, create a new one and paste it here.

Mail

With the same app, people can connect their Outlook mailbox to Mail. Mail signs in to Exchange Online over IMAP and SMTP on each person's behalf; nobody's password passes through Foxx HQ. In the Microsoft Entra admin center, on the same app:

  1. Under Authentication, add a second Web redirect URI: the one the In Microsoft Entra card shows for Mail, ending in /api/microsoft/callback.
  2. Under API permissions → Add a permission → Microsoft Graph → Delegated permissions, add IMAP.AccessAsUser.All, SMTP.Send and offline_access.
  3. Click Grant admin consent for your organization.

Sending also needs Authenticated SMTP allowed for the people who send. Microsoft turns it off in many organizations: in the Microsoft 365 admin center, open Users → Active users → the person → Mail → Manage email apps and tick Authenticated SMTP.

The App registration card shows how many mailboxes are connected. Removing the app disconnects every one of them.

Remove the app

Remove app (in the App registration card) stops Sign in with Microsoft at once and disconnects every mailbox connected to Mail. If it was your only sign-in method besides passwords, everyone may use a password again, so nobody is locked out.

Troubleshooting

Microsoft says "AADSTS50011: The redirect URI … does not match". The redirect URI in Entra doesn't exactly match the one on the Microsoft 365 page. Copy it again and paste it as a Web redirect URI.

Microsoft says "AADSTS7000215: Invalid client secret". The secret is wrong or expired. Paste the secret's Value, not its Secret ID.

The sign-in page says "That account can't sign in here". The person signed in with an account from another Microsoft organization. Only accounts in your own directory can sign in.

The sign-in page says "Nobody in this organization uses that address". Their Microsoft address doesn't match any active user in Foxx HQ. Check the email on their user page matches their Microsoft sign-in name or email.

A red banner says the encryption key is not set. The server can't store the client secret yet. Ask the platform operator.

Mail says "Microsoft no longer accepts this connection". The person's consent was withdrawn, the secret expired, or the mail permissions were removed from the app. Check the permissions above, then have them click Reconnect under Mailbox settings.

Last updated November 6, 2026