Subscribe

Connect your mailboxes

The RFQ tracker can tell you whether a vendor has actually replied, which means Readout has to read mail. It does that through an application you register in your own Microsoft directory — so the credential is yours, and you can revoke it at any time without asking us.

Read this part before you start. Microsoft’s application permissions are all-or-nothing by default: an app granted Mail.Read can read every mailbox in your directory. The mailbox list inside Readout says which ones we ask for — it is not what Microsoft allows. Step 3 is how you actually bound it, and it is the step people skip.

1. Register the application

In the Microsoft Entra admin centre, go to Applications → App registrations → New registration. Give it a name your colleagues will recognise later (“Readout” is fine), leave the account types on single tenant, and skip the redirect URI — nobody signs in, so there is nothing to redirect.

From the new app’s Overview page, copy the Directory (tenant) ID and the Application (client) ID. Both are GUIDs.

Then under Certificates & secrets → New client secret, create a secret and copy the Value column — not the Secret ID, which is a different thing and is the one people paste by mistake. Entra shows the value once.

Note the expiry date you choose. Client secrets expire, and when this one does Readout stops reading mail. The Mailboxes settings page shows the credential as failing when that happens, but nothing will email you about it.

2. Grant permission to list your mailboxes

Under API permissions → Add a permission → Microsoft Graph → Application permissions, add User.Read.All, then click Grant admin consent.

That is what lets Readout show you the list of mailboxes to choose from. It reads names and addresses from your directory — no mail.

3. Grant mail access — scoped, in Exchange

Do not add Mail.Read in Entra. Granting it there gives the application access to every mailbox in your organisation, with nothing to narrow it. Instead grant it through RBAC for Applications in Exchange Online, which lets you attach a scope. (This replaces the older application access policies; if you have used those before, Microsoft has said they will be deprecated.)

First, put the mailboxes Readout should read into a mail-enabled security group. Then, in Exchange Online PowerShell:

# The service principal for the app you registered in step 1.
# -ObjectId is the ENTERPRISE APPLICATION's object id, from
# Entra → Enterprise applications → (your app) → Overview.
# It is NOT the object id on the App registrations page — different
# GUIDs, adjacent screens, and the commonest thing to get wrong here.
New-ServicePrincipal -AppId <application (client) id> \
                     -ObjectId <enterprise application object id> \
                     -DisplayName "Readout"

# Which mailboxes it may touch.
New-ManagementScope -Name "Readout mailboxes" \
  -RecipientRestrictionFilter "MemberOfGroup -eq '<group distinguished name>'"

# Read-only mail access, limited to that scope.
New-ManagementRoleAssignment -App <enterprise application object id> \
  -Role "Application Mail.Read" \
  -CustomResourceScope "Readout mailboxes"

Check it worked, both ways round:

# Should succeed for a mailbox in the group...
Test-ServicePrincipalAuthorization -Identity "Readout" -Resource <a mailbox in the group>

# ...and should NOT for one outside it.
Test-ServicePrincipalAuthorization -Identity "Readout" -Resource <a mailbox outside it>

The two grants add up — they do not intersect. If you grant Mail.Read in Entra and assign a scoped role in Exchange, the application has unscoped access: the scope buys you nothing. If you have already granted Mail.Read in Entra, remove it before relying on a scope.

4. Add it in Readout

Open Settings → Mailboxes in the dashboard, paste the directory id, the client id and the secret, and press Test credentials. A pass means the secret works and Readout can see your directory; it deliberately does not check mail access at this point, because under a scope most mailboxes are legitimately unreadable.

Then Choose mailboxes, tick the ones whose RFQ correspondence you want on the tracker, and save. The sync runs hourly.

If a mailbox says it could not be read

The credential is working and Microsoft refused that particular mailbox. Usually one of:

  • it is outside the management scope from step 3;
  • the account has no Exchange Online licence;
  • the change is simply not live yet — Exchange caches application permissions for up to two hours, so a mailbox you have just added to the group can read as unavailable for a while.

What Readout stores

No message content. For each purchase order it records that a thread exists, when it last moved, who spoke last, and how many messages came from the vendor. Message bodies are fetched at the moment they are read, used to decide whether the thread is about that order, and discarded. The client secret is encrypted at rest and never leaves the server — see our security page.

Setting up the rest of Readout? Start with Connect your Odoo.