Graph Mail integration: the technical setup

Requirements

Licenses

To use a Graph Mail integration with MKG, an Entra environment is required where users have a license that supports an Entra app registration and a Microsoft® 365 mailbox.

License	Entra app registration	Mailbox	Works with MKG
Microsoft Entra ID Free
Microsoft Entra P1
Microsoft Entra P2
M365 Business Basic
M365 Business Standard
M365 Business Premium
Office 365 E1
Office 365 E3
Office 365 E5

Access rights to Entra environment

Specific rights are required to create an app registration in Entra. An administrator must have at least the 'Application Developer' role to perform an app registration. This role provides sufficient rights to create an app and add API permissions. However, to grant admin consent at the tenant level, which is needed for certain permissions such as Microsoft® Graph, the 'Global Administrator' role is required. Therefore, it is advisable that a Global Administrator performs the app registration or is at least available to grant the necessary consent.

Use of a (shared) mailbox

For the email integration, a Microsoft® 365 Email Box must be available for sending and/or receiving emails. A personal mailbox is usually already equipped with the necessary rights. When using a shared mailbox, for example, invoice@contoso.com, the correct permissions must be assigned in the Microsoft® 365 Exchange Admin Center:

• Send As: required to send on behalf of the shared mailbox.
• Full Access: required when full access to the mailbox is necessary.

The shared mailbox must be accessible to all accounts that need to send emails from MKG.

App registration in Entra

Follow the steps below to create an app registration that allows MKG users to send emails via Microsoft Graph Mail, including support for the new Outlook variant.

Step 1: Sign in

Go to the Microsoft Entra Portal and sign in with a user (it is recommended to use a user with the 'Global Administrator' role).

Step 2: New registration

In the menu, select ‘App registrations’ and then the action New registration.

Step 3: Enter the app registration name

For the app registration, enter the name "MKG ERP Graph E-mail (Delegated)" under Name. Select the default option 'Accounts in this organizational directory only (Single tenant)' under 'Supported account types' and choose the action Register.

Step 4: Add API permissions

In the created app registration, go to ‘API permissions’ and choose the action Add a permission and add the following Microsoft Graph permissions (type ‘Delegated’). Then grant admin consent at the tenant level.

Permission	Description	Type	Admin consent required
Mail.ReadWrite	Send email on behalf of a user's mailbox	Delegated
Mail.Send	Read and write email on behalf of a user's mailbox	Delegated
User.Read	Read the profile of the signed-in user	Delegated
Mail.ReadWrite.Shared	Send email on behalf of a mailbox	Delegated
Mail.Send.Shared	Read and write email on behalf of a mailbox	Delegated

Step 5: Configure the authentication settings

In the created app registration, go to the ‘Authentication (Preview)’ tab and open the ‘Redirect URI configuration’ sub-tab. Add a redirect URI for the type ‘Mobile and desktop applications’. Choose https://login.microsoftonline.com/common/oauth2/nativeclient and click Configure to save the changes.

Step 6: Record the client ID and tenant ID

In the created app registration, go to the ‘Overview’ tab. Record the values of both the ‘Application (client) ID’ and the ‘Directory (tenant) ID’. These are needed for the configuration in MKG.