Microsoft 365 Outlook

This guide explains how to set up the inflow from your Microsoft 365 Outlook email inbox — and, optionally, a SharePoint document library — to Paperbox by configuring Microsoft Entra and providing the required permissions.

Add a new "App registration"

1. Go to entra.microsoft.com

2. Log in with your company email address and password

3. Go to Applications and click on App registrations

4. Click on New registration, this will open a new window.

   • Name the new App registration, ideally including the word "Paperbox" for easy identification.
   • Leave all settings on default
   • Click on register

Add a new "Client Secret"

1. Go to Manage and click on Certificates and Secrets
2. Go to the Client secrets tab and create a new client secret with the button New Client Secret
   • Give it an appropriate description
   • Select an expiration date (at least 6 months)
   • Important !Save the Client Secret Value immediately after creation! (This will not be visible anymore once you leave this page.)

Give the correct permissions

Paperbox connects with your app registration without a user sign-in (client credentials flow). Thus, all permissions must be Application permissions. Paperbox does not use Delegated permissions with this app registration.

1. Go to API permissions, click on the Add a permission button and select Microsoft Graph

2. Click on Application permissions and add these permissions:

   Permission	Why Paperbox needs it
   Mail.ReadWrite	Read the emails, move them and set the Paperbox processing category on them
   Mail.Send	Forward emails as part of outflow actions
   MailboxSettings.ReadWrite	Create the Paperbox processing categories in the mailbox
   User.Read.All	Find the mailboxes when you select them in Paperbox

   • For SharePoint document inflow (only necessary if Paperbox must ingest documents from a SharePoint library), also add:

     • Sites.ReadWrite.All
     • Files.ReadWrite.All

     Why write access? After Paperbox ingests a document, it moves the file into an archive folder (by default a "Paperbox Processed" folder that it creates in the same library). Thus, the source folder contains only the files that Paperbox must process. Read-only access is not sufficient for this move.

   • To move bounced emails to a different mailbox (only necessary if you use this outflow action), also add:

     • MailboxFolder.Read.All
     • MailboxItem.Read.All
     • MailboxItem.ImportExport.All

3. Click on Add permissions

4. Click on Grant admin consent for your organization. Application permissions do not work without admin consent. Make sure that the status of each permission is "Granted".

The application permissions above also give access to shared mailboxes. Mail.ReadWrite.Shared and Mail.Send.Shared are not necessary: they exist only as delegated permissions.

Limit access to specific mailboxes (recommended)

Application permissions give access to all mailboxes in your organization. You cannot limit an app registration to some mailboxes in Microsoft Entra. Do this in Exchange Online with an Application Access Policy and a mail-enabled security group that contains the permitted mailboxes. An Exchange administrator must do these steps in Exchange Online PowerShell.

For the procedure, read Limiting organisation-wide access to Microsoft 365 mailboxes. Use the Application (client) ID of your app registration in the policy.

The policy limits Mail.ReadWrite, Mail.Send and MailboxSettings.ReadWrite. It does not limit User.Read.All or the SharePoint permissions.

---

What does Paperbox need at the end?

1. Application (client) ID
2. Directory (Tenant) ID
3. Client Secret Value (So not the secret ID!)
4. Expiration Date of the Client Secret

Once you’ve gathered the required details, please send them securely to Paperbox to complete the setup.