Microsoft 365 Mail (Send As User - Enterprise Only)

By default, every email DocMgt sends goes out through the email server configured in Email Server Settings, and it comes from the Default 'From' Address. Microsoft 365 Mail changes that for email a user writes themselves. When it is enabled, an email a user sends from a Record goes out through Microsoft 365 as that user, so it comes from their own address and appears in their own Sent Items in Outlook. Workflow notifications, reminders, and other automatic email are not affected and continue to use the Default 'From' Address and the email server settings.

The settings are in Administration, under System Main Options, in the Email Server Settings section, on the card labeled Microsoft 365 Mail (send as the user).


Microsoft 365 Mail integration is available in Enterprise edition or higher


Before you start: your Microsoft 365 administrator

DocMgt sends through Microsoft 365 using an application that your Microsoft 365 administrator registers in Microsoft Entra ID. This is a one-time setup for the whole organization; individual users do not sign in to anything. The administrator will need to do the following in the Microsoft Entra admin center.

  1. Register an application. Under App registrations, create a new registration for a single tenant. No redirect URI is needed. Note the Application (client) ID and the Directory (tenant) ID shown on the overview page; both are entered in DocMgt.
  2. Create a client secret. Under Certificates & secrets, add a new client secret and copy its value right away. The value is shown only once. Note the expiration date as well: when the secret expires, DocMgt can no longer send as users until a new secret is entered.
  3. Grant the application permission to send. Under API permissions, add a permission from Microsoft Graph, choose Application permissions (not Delegated permissions), and add Mail.Send. If you also want emails with attachments over 3 MB to go out as the user, add Mail.ReadWrite in the same way. Then click Grant admin consent for your organization. Adding the permission is not enough on its own; consent must be granted.
  4. Optionally let users look up recipients. In the same API permissions screen, add the Application permission Contacts.Read to let the Send Email screen search the sender's own Outlook contacts, and User.ReadBasic.All to let it search your organization's directory. The two permissions are independent and either one on its own is enough to show a contact search box next to the To, CC, and BCC fields on that screen: with only Contacts.Read the box searches the sender's own contacts, with only User.ReadBasic.All it searches the directory, and with both it searches both. Grant admin consent again after adding them. The search box disappears only when neither permission is granted, and then the screen is unchanged and users type addresses as before. To turn a lookup off later, revoke the permission under Enterprise applications rather than only removing it from the application's API permissions list; removing it there leaves the consent in place and the search box stays until the consent itself is revoked. Send Test As Me shows which lookups are currently on.
  5. Optionally limit which mailboxes the application may use. With Mail.Send alone the application can send as any mailbox in your organization, and Mail.ReadWrite also lets it read and change mail in any mailbox. Exchange Online can restrict the application to the members of a mail-enabled security group with an application access policy. Most organizations that grant Mail.ReadWrite will want this restriction in place.


The DocMgt email address of each user who should send this way must be the address of a mailbox in that Microsoft 365 organization. A user whose DocMgt email address does not match a mailbox keeps sending through the DocMgt email server as before.


Entering the settings in DocMgt

  • Send As User turns the feature on. Leave it off until the fields below are filled in and the test has passed.
  • Tenant ID is the Directory (tenant) ID from the application overview page. A verified domain of the organization, such as contoso.com, also works.
  • Client ID is the Application (client) ID from the same page.
  • Client Secret is the secret value copied when the secret was created. It is stored encrypted and is never shown again after saving. When a secret is saved, the field shows a placeholder saying so; leave it blank to keep the saved secret, or enter a new value to replace it. Check Remove the saved secret to delete it.
  • Sender Domains is optional. Enter one or more email domains separated by semicolons to send through Microsoft 365 only for users whose email address is in one of those domains. Leave it blank to include every user whose address matches a mailbox.
  • If Sending Fails controls what happens when Microsoft 365 will not send a particular email as the user. When it is on, the email is sent through the email server instead and the sender is told that it will not be in their Sent Items. When it is off, the sender sees an error and nothing is sent.

Click Save Microsoft 365 Settings to save the card. This button is separate from the Save button for the rest of System Main Options.


Testing

Click Send Test As Me to send a short message from your own address to your own address through Microsoft 365, using the values currently on the card. The values do not have to be saved first, and a blank Client Secret means the saved one is used. If the test succeeds, check your Inbox and your Sent Items in Outlook for the message. The result also says whether attachments over 3 MB are supported, which depends on whether Mail.ReadWrite was granted, and whether contact lookup and directory lookup are on, which depend on Contacts.Read and User.ReadBasic.All.


If the test fails, the message explains what to fix. The most common causes are a permission that was added as Delegated instead of Application, admin consent not yet granted, an expired secret, a DocMgt email address that is not a mailbox in the organization, or an application access policy that does not include your mailbox. If you granted consent moments before testing and still see an access denied message, wait a minute and test again.


Attachments over 3 MB

Microsoft 365 handles emails with attachments over 3 MB differently, and that path requires the Mail.ReadWrite permission in addition to Mail.Send. When Mail.ReadWrite has been granted, those emails go out as the user like any other. When it has not, they are sent through the standard DocMgt email server instead and the sender is told that the email will not appear in their Sent Items. The "Send Test As Me" result shows which case applies. A single attachment larger than 150 MB cannot be sent through Microsoft 365 at all.


What users see

When a user sends an email from a Record and Microsoft 365 Mail applies to them, the email comes from their own address and appears in their Sent Items in Outlook. Nothing changes in the send dialog. If the email had to be sent through the email server instead, the dialog shows a warning after sending, for example: This email was sent through the system email server because its attachments are larger than your Microsoft 365 connection allows. It was delivered, but it will not appear in your Sent Items. Users to whom the feature does not apply are not shown anything; their email is sent as it always was.


When Contacts.Read or User.ReadBasic.All has been granted, users to whom Microsoft 365 Mail applies also see a contact search box beside each of the To, CC, and BCC fields on the Send Email screen (below the field on narrower screens). Typing two or more characters searches their own Outlook contacts, the organization's directory, or both, depending on which of the two permissions were granted, and each result is labeled Contacts or Directory to show where it came from. If only one permission is granted, the box still appears and searches that one source. Choosing a result adds that address to the field next to it; addresses can still be typed directly as before. Users to whom the feature does not apply, and every user when neither permission is granted, see the screen exactly as it was.


Emails sent through Microsoft 365 are recorded in the Email Messages report like any other email, with the user's address as the From address.


When the client secret expires

Client secrets in Microsoft Entra ID expire on the date chosen when they were created. After that date, DocMgt can no longer send as users. With If Sending Fails on, email keeps going out through the email server and senders see the warning; with it off, sends fail. Have your Microsoft 365 administrator create a new secret for the same application, enter it in Client Secret, save, and run the test again.