Active Directory Pro
Login Free Trial

Email Server

Add email server for schedule reports and alert notifications.

Settings > Email Server is where you tell 365 Pro Toolkit how to send mail. Nothing in the product emails anybody until this is configured.

Three features depend on it:

  • Alerts, which email you when a rule triggers.
  • Scheduled reports, which email a report on a schedule.
  • Automations, which email their results, including the Report only mode that tells you what an automation would have done.

If any of those look like they ran but nothing arrived, this page is the first place to check.

Choose a method

The Email type box offers two.

  • SMTP server. Any mail server that accepts SMTP, including Microsoft 365, Google Workspace, an on premises Exchange server, or an internal relay. The simplest option if you already have a relay that accepts mail from your servers.
  • Microsoft 365 (Graph). Sends through Microsoft Graph using an app registration, with no SMTP at all. Use this where SMTP authentication is disabled in your tenant, which is now the Microsoft default.

Both send from the same From address and From name, which appear on every message the toolkit sends.

SMTP

  1. Go to Settings > Email Server and choose SMTP server.
  2. Fill in the SMTP server name, for example smtp.office365.com or the name of your internal relay.
  3. Set the Port. 587 is the usual choice, and 25 is common for an internal relay that does not authenticate.
  4. Set Encryption to SSL / TLS unless you are relaying internally over a trusted network.
  5. Enter a Username and Password if the server requires authentication. Leave both blank to send anonymously, which is what most internal relays expect.
  6. Enter the From address and From name.
  7. Send a test, then click Save.

Port 465 is treated as implicit TLS, and any other port with encryption on uses STARTTLS. You do not have to tell the toolkit which, it follows the port.

A note on Microsoft 365 over SMTP

Microsoft has disabled basic authentication for SMTP in most tenants, so smtp.office365.com with a username and password often fails even though the credentials are correct. If that happens, either set up an authenticated SMTP relay in Exchange Online for the server's IP address, or use the Microsoft 365 (Graph) method below, which does not use SMTP and is not affected.

Microsoft 365 (Graph)

This method needs its own app registration with the Mail.Send application permission. It is deliberately separate from the app registration that connects your tenant, so that the ability to send mail is not bundled into the toolkit's main permissions.

1. Create the app registration

  1. In the Microsoft Entra admin center, go to Identity > Applications > App registrations and click New registration.
  2. Name it, for example 365 Pro Toolkit Mail, choose Accounts in this organizational directory only, and leave the redirect URI empty.
  3. Copy the Application (client) ID and the Directory (tenant) ID from the overview page.
  4. Under API permissions, add the Microsoft Graph application permission Mail.Send, then click Grant admin consent.
  5. Under Certificates & secrets, create a client secret and copy its Value straight away. It is only shown once.

2. Enter the details

  1. Go to Settings > Email Server and choose Microsoft 365 (Graph).
  2. Enter the Directory (tenant) ID, Application (client) ID and Client secret.
  3. Enter the From address. This must be a real mailbox in that tenant, because the toolkit sends as that mailbox. A shared mailbox such as it-alerts@contoso.com works well and does not consume a license.
  4. Enter the From name.
  5. Send a test, then click Save.

Restricting which mailbox it can send as

Mail.Send as an application permission lets the app send as any mailbox in the tenant. Most organizations narrow that with an Exchange Online application access policy, which limits the app registration to a single mailbox or a mail-enabled security group. Microsoft documents this as limiting application permissions to specific mailboxes. It is worth doing, and the toolkit works normally with such a policy in place as long as the From address is one of the permitted mailboxes.

Sent messages are not saved to the mailbox's Sent Items.

Test it

The Send a test email box sends a short message to whatever address you type in it.

The test uses the values currently on screen, so you do not have to save first. That is deliberate: you can try a setting, see whether it works, and only then commit it. Equally, a test that passes means nothing until you click Save.

A failed test shows the error the mail server or Microsoft returned, rather than a generic failure, so the message is usually enough to tell you what is wrong.