Connect your mailboxes

The RFQ tracker can tell you whether a vendor has actually replied, which means Readout has to read mail. And your reports — the morning call sheet, the wellness check, the summaries — can come from one of your own mailboxes rather than from Readout’s address. Both go through an application you register in your own Microsoft directory — so the credential is yours, and you can revoke it at any time without asking us.

You can set up either half on its own: skip the Mail.Read grant if you only want reports sent from your domain, or the Mail.Send grant if you only want the RFQ tracker.

1. Register the application

In the Microsoft Entra admin centre, go to Applications → App registrations → New registration. Give it a name your colleagues will recognise later (“Readout” is fine), leave the account types on single tenant, and skip the redirect URI — nobody signs in, so there is nothing to redirect.

From the new app’s Overview page, copy the Directory (tenant) ID and the Application (client) ID. Both are GUIDs.

Then under Certificates & secrets → New client secret, create a secret and copy the Value column — not the Secret ID, which is a different thing and is the one people paste by mistake. Entra shows the value once.

Note the expiry date you choose. Client secrets expire, and when this one does Readout stops reading mail. The Mailboxes settings page shows the credential as failing when that happens, but nothing will email you about it.

2. Grant permission to list your mailboxes

Under API permissions → Add a permission → Microsoft Graph → Application permissions, add User.Read.All, then click Grant admin consent.

That is what lets Readout show you the list of mailboxes to choose from. It reads names and addresses from your directory — no mail.

3. Grant mail access — scoped, in Exchange

Do not add Mail.Read or Mail.Send in Entra. Granting either there gives the application that access over every mailbox in your organization, with nothing to narrow it. Instead grant it through RBAC for Applications in Exchange Online, which lets you attach a scope. (This replaces the older application access policies; if you have used those before, Microsoft has said they will be deprecated.)

First, put the mailboxes Readout should read into a mail-enabled security group, and the one mailbox your reports should come from (reports@, say) into a second group of its own. Keep them apart: the mailbox you send from is rarely one anybody reads RFQs from, and nothing needs to send as a buyer’s own inbox. Then, in Exchange Online PowerShell:

# The service principal for the app you registered in step 1.
# -ObjectId is the ENTERPRISE APPLICATION's object id, from
# Entra → Enterprise applications → (your app) → Overview.
# It is NOT the object id on the App registrations page — different
# GUIDs, adjacent screens, and the commonest thing to get wrong here.
New-ServicePrincipal -AppId <application (client) id> \
                     -ObjectId <enterprise application object id> \
                     -DisplayName "Readout"

# Which mailboxes it may touch.
New-ManagementScope -Name "Readout mailboxes" \
  -RecipientRestrictionFilter "MemberOfGroup -eq '<group distinguished name>'"

# Read-only mail access, limited to that scope.
New-ManagementRoleAssignment -App <enterprise application object id> \
  -Role "Application Mail.Read" \
  -CustomResourceScope "Readout mailboxes"

# The mailbox reports are sent from, in its own scope.
New-ManagementScope -Name "Readout sender" \
  -RecipientRestrictionFilter "MemberOfGroup -eq '<sender group distinguished name>'"

# Send-as for that mailbox only.
New-ManagementRoleAssignment -App <enterprise application object id> \
  -Role "Application Mail.Send" \
  -CustomResourceScope "Readout sender"

Check it worked, both ways round:

# Should succeed for a mailbox in the group...
Test-ServicePrincipalAuthorization -Identity "Readout" -Resource <a mailbox in the group>

# ...and should NOT for one outside it.
Test-ServicePrincipalAuthorization -Identity "Readout" -Resource <a mailbox outside it>

4. Add it in Readout

Open Settings → Mailboxes in the dashboard, paste the directory id, the client id and the secret, and press Test credentials. A pass means the secret works and Readout can see your directory; it deliberately does not check mail access at this point, because under a scope most mailboxes are legitimately unreadable.

Then Choose mailboxes, tick the ones whose RFQ correspondence you want on the tracker, and save. The sync runs hourly.

To send reports from your own domain, open Reports sent from, pick the mailbox from step 3’s second group, and save. Nothing is sent at that moment: the next report due is the first real check, and the card shows whether it went. A copy of every report lands in that mailbox’s Sent Items, so your own mail system keeps the record of what went out in your name.

If a mailbox says it could not be read

The credential is working and Microsoft refused that particular mailbox. Usually one of:

• it is outside the management scope from step 3;
• the account has no Exchange Online licence;
• the change is simply not live yet — Exchange caches application permissions for up to two hours, so a mailbox you have just added to the group can read as unavailable for a while.

If reports say they are not sending

Microsoft refused to send as that mailbox, and those reports are not going out — Readout does not quietly switch to its own address, because mail arriving from a sender you did not choose would hide the problem. Check that the mailbox is in the sender group and that the Application Mail.Send assignment exists, then allow for the same two-hour Exchange cache. Or choose Readout’s own address in the meantime.

What Readout stores

No message content. For each purchase order it records that a thread exists, when it last moved, who spoke last, and how many messages came from the vendor. Message bodies are fetched at the moment they are read, used to decide whether the thread is about that order, and discarded. The client secret is encrypted at rest and never leaves the server — see our security page.

Setting up the rest of Readout? Start with Connect your Odoo.