Skip to content

Microsoft 365 email

The messaging service can send email notifications through Microsoft 365 (M365) by using the Microsoft Graph API.

Use this integration when LogMan.io notifications, alerts, or reports should be sent from a mailbox in a Microsoft 365 tenant.

The messaging service supports two Microsoft 365 modes:

  • App mode: the messaging service sends email as an application.
  • Delegated mode: the messaging service sends email on behalf of a signed-in Microsoft 365 user.

Prerequisites

Ensure that the LogMan.io server has outbound HTTPS access on TCP port 443 to:

  • graph.microsoft.com
  • login.microsoftonline.com

Access to Microsoft Entra ID is required, with permissions to create or update an app registration and grant consent.

App mode

App mode uses Microsoft Graph application permissions. Use this mode when the service should send email automatically without a user signing in.

This is the recommended mode for service notifications and backend automation.

Required configuration fields

Field Description
mode Set to app.
api_url Microsoft Graph send-mail endpoint. Use https://graph.microsoft.com/v1.0/users/{}/sendMail.
tenant_id Microsoft Entra Directory (tenant) ID.
client_id Application (client) ID of the app registration.
client_secret Client secret value from the app registration.
user_email Mailbox that the messaging service sends from.

Configuration sample

Edit model.yaml to configure the asab-iris service:

/Site/model.yaml
define:
  type: rc/model

services:
  asab-iris:
    instances:
      - node1
    asab:
      config:
        m365_email:
          mode: app
          api_url: https://graph.microsoft.com/v1.0/users/{}/sendMail
          tenant_id: "{{M365_TENANT_ID}}"
          client_id: "{{M365_CLIENT_ID}}"
          client_secret: "{{M365_CLIENT_SECRET}}"
          user_email: "noreply@example.com"

Azure configuration

  1. Open Microsoft Entra admin center.
  2. Go to Applications > App registrations.
  3. Click New registration.
  4. Enter a descriptive name, for example LogMan.io Notifications Email.
  5. Select Accounts in this organizational directory only.
  6. Leave Redirect URI empty.
  7. Click Register.
  8. On the Overview page, copy:
  9. Application (client) ID to client_id
  10. Directory (tenant) ID to tenant_id
  11. Go to Certificates & secrets.
  12. Click New client secret.
  13. Copy the secret Value to client_secret.

Warning

The client secret value is shown only once. Store it securely before leaving the page.

API permissions

  1. Open the app registration.
  2. Go to API permissions.
  3. Click Add a permission.
  4. Select Microsoft Graph.
  5. Select Application permissions.
  6. Add Mail.Send.
  7. Click Grant admin consent for the organization.

Security recommendation

The Mail.Send application permission can allow the application to send as any mailbox in the tenant. Use an Exchange Online Application Access Policy to restrict the app to the mailbox configured in user_email.

Apply the configuration

  1. Store the secret values in Vault or in the deployment secret store used by the LogMan.io installation.
  2. Update /Site/model.yaml.
  3. Apply the model from the Library, or run the deployment apply command used by the installation.
  4. Send a test notification and verify that the message is delivered from the configured user_email mailbox.

Verify the configuration

The app mode configuration is ready when:

  • the service starts without Microsoft 365 configuration errors
  • the app registration has Microsoft Graph Mail.Send application permission
  • admin consent has been granted
  • a test email is delivered from the configured user_email mailbox
  • the service logs do not contain Microsoft Graph authentication errors

Delegated mode

Delegated mode uses Microsoft Graph delegated permissions. Use this mode when the messaging service must send email on behalf of a specific Microsoft 365 user.

Delegated mode requires a one-time browser authorization. The user who signs in must be the mailbox user configured in user_email, or a user allowed by Microsoft 365 to send as that mailbox.

Required configuration fields

Field Description
mode Set to delegated.
api_url Microsoft Graph send-mail endpoint. Use https://graph.microsoft.com/v1.0/users/{}/sendMail.
tenant_id Microsoft Entra Directory (tenant) ID.
client_id Application (client) ID of the app registration.
client_secret Client secret value from the app registration.
user_email Mailbox that the messaging service sends from.
redirect_uri Public authorization callback URL ending with /authorize_ms365.

Configuration sample

/Site/model.yaml
define:
  type: rc/model

services:
  asab-iris:
    instances:
      - node1
    asab:
      config:
        m365_email:
          mode: delegated
          api_url: https://graph.microsoft.com/v1.0/users/{}/sendMail
          tenant_id: "{{M365_TENANT_ID}}"
          client_id: "{{M365_CLIENT_ID}}"
          client_secret: "{{M365_CLIENT_SECRET}}"
          user_email: "notifications@example.com"
          redirect_uri: "https://logman.example.com/api/asab-iris/authorize_ms365"

authorize_ms365 URL

The authorize_ms365 URL starts the Microsoft sign-in flow for delegated mode.

Open this URL in a browser after delegated mode is configured. The service redirects the browser to Microsoft sign-in. After successful sign-in, Microsoft redirects back to the same service endpoint and the service stores the delegated authorization for future emails.

How to construct the URL

Build the URL from the public browser-accessible service address:

<public service base URL>/authorize_ms365

If the service is exposed behind a reverse proxy with a path prefix, include the prefix:

https://logman.example.com/api/asab-iris/authorize_ms365

The value must be configured in two places:

  1. In Microsoft Entra ID app registration as a Redirect URI.
  2. In the m365_email.redirect_uri configuration field.

Danger

The Redirect URI in Microsoft Entra ID and the redirect_uri value in m365_email.redirect_uri must match exactly, including https, hostname, port, and path.

Azure configuration

  1. Open Microsoft Entra admin center.
  2. Go to Applications > App registrations.
  3. Create a new app registration, or open the app registration used for messaging and notifications.
  4. Copy Application (client) ID to client_id.
  5. Copy Directory (tenant) ID to tenant_id.
  6. Go to Authentication.
  7. Add a platform for Web.
  8. Add the exact redirect_uri, for example https://logman.example.com/api/asab-iris/authorize_ms365.
  9. Go to Certificates & secrets and create a client secret.
  10. Copy the secret Value to client_secret.

API permissions

  1. Open the app registration.
  2. Go to API permissions.
  3. Click Add a permission.
  4. Select Microsoft Graph.
  5. Select Delegated permissions.
  6. Add Mail.Send.
  7. Grant admin consent if the organization requires it.

Authorize delegated sending

  1. Configure m365_email with mode: delegated.
  2. Apply the LogMan.io model.
  3. Open the public authorize_ms365 URL in a browser.
  4. Sign in with the Microsoft 365 user that should send emails.
  5. After the success message is shown, close the browser window.
  6. Send a test notification.

If authorization is missing, the service returns an error containing an authorize_url. Open that URL in a browser and complete the sign-in.

Verify the configuration

The delegated mode configuration is ready when:

  • the service starts without Microsoft 365 configuration errors
  • the app registration has Microsoft Graph Mail.Send delegated permission
  • redirect_uri matches the Redirect URI in Microsoft Entra ID
  • opening authorize_ms365 completes with a success message

Email templates

Email templates must be stored in the /Templates/Email/ directory in the Library.

MS365 email supports attachments. The service sends them as Microsoft Graph file attachments.

For more information about email notifications and templates, see: