Skip to main content

Microsoft 365 Email Onboarding

This guide is for IT administrators who need to grant Autena read access to specific mailboxes in their Microsoft 365 tenant.

Overview​

Autena's email connector reads logistics emails (e.g., booking confirmations, tracking updates) from your mailboxes via the Microsoft Graph API. You control exactly which mailboxes Autena can access.

The setup has two steps:

  1. Grant admin consent — authorizes the Autena app in your tenant
  2. Restrict to specific mailboxes — limits access to only the mailboxes you choose

Prerequisites​

  • Step 1 (admin consent) requires a Privileged Role Administrator, Application Administrator, or Cloud Application Administrator role
  • Step 2 (mailbox scoping) requires an Exchange Administrator role or membership in the Organization Management role group
  • You need the Exchange Online PowerShell module installed
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser

Autena will send you a personalized consent link for your tenant. Open it in your browser while signed in as a tenant administrator.

Use the link Autena sends you — don't hand-build a consent URL. The link carries a short-lived signed token that the confirmation page checks; a manually assembled URL is missing that token and will fail with "Consent Not Completed". The link is valid for 10 minutes — if it expires, ask Autena for a fresh one.

You will see a consent prompt for "Autena Connector Platform" requesting "Read mail in all mailboxes". Click Accept.

After accepting, you will be redirected to a confirmation page showing your tenant ID. If something went wrong, the page will display the error (with a reference code) and instructions to contact support.

Important: At this point, Autena has access to all mailboxes in your tenant. Step 2 restricts this to only the mailboxes you specify.

Step 2: Restrict Access to Specific Mailboxes​

2a. Connect to Exchange Online​

Import-Module ExchangeOnlineManagement
Connect-ExchangeOnline -UserPrincipalName admin@yourdomain.com

2b. Create a Mail-Enabled Security Group​

Create a group that contains only the mailboxes Autena should access:

New-DistributionGroup -Name "Autena Allowed Mailboxes" -Type Security -ManagedBy admin@yourdomain.com

Add the specific mailboxes:

Add-DistributionGroupMember -Identity "Autena Allowed Mailboxes" -Member logistics@yourdomain.com
Add-DistributionGroupMember -Identity "Autena Allowed Mailboxes" -Member dispatch@yourdomain.com

Note: You must use a mail-enabled security group. Regular distribution groups and Microsoft 365 groups are not supported. Shared mailboxes and resource mailboxes should be added as members of the group, not targeted directly.

2c. Create the Application Access Policy​

New-ApplicationAccessPolicy `
    -AppId "81c0da49-6870-4ba8-8c10-be92c72a7810" `
    -PolicyScopeGroupId "Autena Allowed Mailboxes" `
    -AccessRight RestrictAccess `
    -Description "Restrict Autena to logistics mailboxes"

This restricts the Autena app to only the mailboxes in the group. All other mailboxes are inaccessible.

2d. Verify the Policy​

Test that an allowed mailbox is accessible:

Test-ApplicationAccessPolicy -Identity logistics@yourdomain.com -AppId "81c0da49-6870-4ba8-8c10-be92c72a7810"
# Expected: output indicates access is Granted

Test that other mailboxes are blocked:

Test-ApplicationAccessPolicy -Identity ceo@yourdomain.com -AppId "81c0da49-6870-4ba8-8c10-be92c72a7810"
# Expected: output indicates access is Denied

Before sending your mailbox list to Autena, confirm every allowed mailbox returns Granted. Testing a single mailbox can hide gaps that silently block the entire sync:

Get-DistributionGroupMember "Autena Allowed Mailboxes" | ForEach-Object {
    $r = Test-ApplicationAccessPolicy -Identity $_.PrimarySmtpAddress -AppId "81c0da49-6870-4ba8-8c10-be92c72a7810"
    "{0}: {1}" -f $_.PrimarySmtpAddress, $r.AccessCheckResult
}
# Every line should read "Granted". Any "Denied" means that mailbox will not sync —
# re-check the Application Access Policy below before proceeding.

Propagation delay: The Test-ApplicationAccessPolicy command shows results immediately, but the actual Graph API enforcement can take 30 minutes to 2 hours to propagate depending on app usage patterns. During this window, Autena may still be able to access mailboxes outside the group.

Step 3: Send Autena Your Connection Details​

Once admin consent and the Application Access Policy are in place, send Autena support the following so we can finish wiring up the connection on our side:

  1. Your Microsoft Entra tenant ID — the GUID shown on the consent confirmation page (you can also find it in the Entra admin center under Overview → Tenant ID).
  2. The UPN of every mailbox that should be synced — these must match the members of the Autena Allowed Mailboxes security group from Step 2 (e.g. logistics@yourdomain.com, dispatch@yourdomain.com).
  3. Optional folder scoping — by default Autena syncs Inbox and Sent Items plus user-created folders. Tell us if you want a different folder set.

Autena registers each mailbox as a separate connection. You'll receive a confirmation when each one is active and syncing.

Managing Access Over Time​

Add a mailbox​

Add-DistributionGroupMember -Identity "Autena Allowed Mailboxes" -Member newmailbox@yourdomain.com

Remove a mailbox​

Remove-DistributionGroupMember -Identity "Autena Allowed Mailboxes" -Member oldmailbox@yourdomain.com

View current members​

Get-DistributionGroupMember -Identity "Autena Allowed Mailboxes" | Format-Table DisplayName, PrimarySmtpAddress

View current policies​

Get-ApplicationAccessPolicy | Format-Table Description, ScopeName, AccessRight, AppId

Revoke all access​

To completely remove Autena's access to your tenant:

# Find the policy Identity value
Get-ApplicationAccessPolicy | Where-Object { $_.AppId -eq "81c0da49-6870-4ba8-8c10-be92c72a7810" } | Format-List Identity, Description, ScopeName, AccessRight

# Remove by the Identity value shown above (a GUID string)
Remove-ApplicationAccessPolicy -Identity "<Identity from above>"

# Remove admin consent (via Entra admin center)
# Go to: Enterprise applications > Autena Connector Platform > Properties > Delete

Troubleshooting​

SymptomCauseFix
Consent URL shows "No reply address registered"Using the wrong URL formatUse the exact URL from Step 1 — do not modify the redirect_uri parameter
Test-ApplicationAccessPolicy returns "Granted" but API calls failPropagation delayWait 30 minutes to 2 hours and retry
New-ApplicationAccessPolicy fails with group errorWrong group typeEnsure you created a security group (-Type Security), not a regular distribution group
App can still read unrestricted mailboxesPolicy not propagated yetWait up to 2 hours; verify with Get-ApplicationAccessPolicy that the policy exists
Autena can't access any of the allowed mailboxes (403 / access denied), even though consent succeeded and the group has membersThe Application Access Policy is misconfigured — most often created with -AccessRight DenyAccess (inverted), or -PolicyScopeGroupId / -AppId pointing at the wrong group or appRun Get-ApplicationAccessPolicy (see Managing Access → View current policies) and confirm AccessRight is RestrictAccess, ScopeName is Autena Allowed Mailboxes, and AppId is 81c0da49-…. Then Test-ApplicationAccessPolicy on a member mailbox should return Granted

Reference​