Microsoft Graph Connector

The Microsoft Graph connector sends email from Business Central through a Microsoft 365 mailbox using the Microsoft Graph API. The connector authenticates with its own credentials through an Entra ID app registration — no user login is involved.

How It Works

You register an application in Microsoft Entra ID (Azure AD), grant it the application permission Mail.Send, and give Business Central the tenant id, client id, and a client secret. Business Central then acquires a token with those credentials and sends mail as the mailbox you specify.

Prerequisites

A Microsoft 365 / Entra ID tenant where you can create an app registration and grant admin

consent (you need an administrator for the consent step).

A real user mailbox or shared mailbox to send from. A distribution group cannot send; a

shared mailbox works and needs no license.

The Allow HttpClient Requests setting enabled for the ToolBox extension.

Step 1 — Create the App Registration

Go to portal.azure.com → Microsoft Entra ID → *App

registrations** → New registration*.

Give it a recognizable name (for example, Business Central Email). Keep it Single tenant.

No redirect URI is needed.

On the Overview page, copy the Application (client) ID and the *Directory (tenant)

ID** — you need both later.

Step 2 — Add the Mail.Send Permission

Open API permissions → Add a permission → Microsoft Graph → *Application

permissions** → check Mail.Send*.

Click Grant admin consent for <tenant>. The permission row must show a green check

mark.

Only if you also use the email download feature: add Mail.Read the same way.

Pitfall 1 — Application, not Delegated. Choose Application permissions. Delegated permissions are silently ignored by this connector and sending fails with ErrorAccessDenied.

Pitfall 2 — Microsoft Graph, not Exchange. Add the permission under Microsoft Graph, not Office 365 Exchange Online. Both APIs have a permission named Mail.Send — only the Graph one works here.

Pitfall 3 — Consent must follow the add. Adding the permission is not enough; admin consent must be granted after the permission is added.

Step 3 — Create a Client Secret

Open Certificates & secrets → New client secret and pick a lifetime.
Copy the Value column immediately — it is shown only once. Do not copy the Secret ID;

that is not the secret.

Tip: secrets expire (24 months at most). Set a calendar reminder. When rotating, only the Client Secret field on the account card needs updating.

Step 4 — Register the Account in Business Central

Search for Email Accounts → Add an email account → choose Microsoft Graph (ToolBox).
Fill in the account card:

Field	Description
Account Name	A name to identify this account in Business Central.
Sender Email Address	The mailbox to send from — a real user or shared mailbox.
Tenant Id	The Directory (tenant) ID from Step 1.
Client Id	The Application (client) ID from Step 1.
Client Secret	The secret Value from Step 3 (stored in IsolatedStorage, never in the database).
Enabled	The send mode — see the Enabled modes.
Redirect Email Address	Only used when Enabled (Redirect) is selected.

Tip: the sender must be a real user mailbox or shared mailbox — a distribution group cannot send. A shared mailbox works fine and needs no license.

Step 5 — Verify the Setup

Test Connection acquires a token and decodes it. Read the Application roles line:

Mail.Send must be listed. The report also verifies the audience, the tenant, and the app id, and probes whether the mailbox is reachable.

Send Test Email sends a message from the mailbox to itself — the definitive end-to-end

proof. When it succeeds, normal sending works too.

Troubleshooting ErrorAccessDenied

Run Test Connection first, then match your situation:

Test Connection says	Cause	Fix
Token acquisition fails (`AADSTS…`)	Wrong tenant id, client id, or secret. `AADSTS7000215` = invalid secret (often the Secret ID was pasted instead of the Value).	Correct the credentials; create a new secret if the Value is lost.
`Mail.Send` missing from the roles line	Permission is Delegated, consent not granted, wrong API (Office 365 Exchange Online), or you are checking a different app/tenant than the one configured.	Fix the permission per Step 2 and re-grant admin consent.
`Mail.Send` present, mailbox read works, sending still denied	Exchange consent propagation lag. Entra puts the role in the token immediately, but Exchange Online caches app permissions — it can take from 30 minutes up to several hours after consent before sending is accepted.	Nothing is misconfigured. Wait and retry Send Test Email periodically.
Mailbox read is also denied	An Exchange application access policy or RBAC blocks the app, or the address is not a real mailbox.	Verify with `Get-Mailbox` that the sender is a user or shared mailbox; check application access policies (below).

Restricting the App to Specific Mailboxes

By default, an app with the Mail.Send application permission can send as any mailbox in the tenant. Exchange application access policies restrict it — recommended for production:

Connect-ExchangeOnline

# Is the app allowed for the mailbox? (the same check Exchange runs on every call)
Test-ApplicationAccessPolicy -Identity support@yourdomain.com -AppId <client id>

# Restrict the app to the members of a mail-enabled security group
New-ApplicationAccessPolicy -AppId <client id> -PolicyScopeGroupId <group address> `
    -AccessRight RestrictAccess -Description "BC email connector - allowed mailboxes"

Good to know: Get-ApplicationAccessPolicy fails with a confusing "object … couldn't be found" error when no policies exist at all — that means "none", not that something is broken.

No PowerShell installed? Use the browser-based Azure Cloud Shell (the >_ icon at portal.azure.com), then Install-Module ExchangeOnlineManagement and Connect-ExchangeOnline -Device. There is no portal UI for these policies — only the group membership can be managed in the Microsoft 365 admin center.

Policy changes take up to ~30 minutes to propagate. Combined with the consent lag above: when everything checks out, patience beats reconfiguration.