What the Microsoft Entra ID and Mail pages show
Connect your Microsoft tenant once to get client Microsoft 365 sync, dispatch calendars, CyberSentry sign-in monitoring and your help desk mailbox. The Entra ID page creates and checks the connection, and the Mail page points help desk, billing and training mail at your mailboxes.
What this connection is for
Integrations, then Microsoft Entra ID. One connection to your own Microsoft tenant carries the client tenants you sync users and licenses from, the calendars dispatch books techs onto, the sign-in data CyberSentry watches and, if your mail runs on Microsoft 365, the mailboxes that send and receive ticket email.
Setting it up
Before anything is connected the page opens with Connect Microsoft as Admin. After that sign-in it offers Run Azure App Creation, which creates the MSP Runtime, Client Access and Mail Auth registrations in your own Microsoft tenant in one pass. The Connect Microsoft wizard walks the same setup lesson by lesson and checks each part; the article How to use the Connect Microsoft wizard covers it.
MSP Runtime App
The app registration that reads and manages your own Microsoft tenant. Its row shows the App (client) ID, the Permission set it is on with an Up to date or Update available badge, and its Secret expiry counted in days.
Client Access App
The narrower app your clients grant consent to. It shows the same facts plus Consented client tenants, the count of client tenants already on it.
Clients still on the old app
An amber note counts the client tenants that are still syncing through the legacy shared app. They keep syncing, and each one moves across when that client re-consents.
Tenant and the last two checks
Which Microsoft tenant is connected, when a token was last tested (Last token test) and when the permissions were last checked (Last permission check).
The Microsoft apps menu
The menu on the Microsoft apps card holds Test Graph connection, Rotate Credentials and Generate PowerShell script. Update Graph Permissions joins them only when a newer permission set is available, which is why it is absent while both apps read Up to date.
Mailbox to connect
On the Mail page, type the mailbox you want to connect, for example [email protected], then press Authorize a Mailbox. Leave the field blank to connect whichever mailbox you sign in as. The note between the two says what happens on Microsoft's own sign-in screen next.
Help Desk, Billing and Training
The three mail functions. Each one shows Ready or Held, the mailbox it currently uses, a picker to point it at any authorized mailbox, and a switch to turn that function's mail on or off. Held means no mailbox is connected yet, and that function's mail waits.
Authorized mailboxes
Every mailbox authorized here, with Connected, Pending or Error, and via the account that signed in to authorize it when that account is not the mailbox itself. Send test email sends a real message from that mailbox, which is a real proof that sending works.
Sync health
The scheduled background jobs this integration owns, with their last run, next run and recent failures. Open it when a client's Microsoft data looks stale.
Legacy credentials
The Client ID, Client Secret and Tenant ID of the legacy shared app. This card only appears while those values still exist. Remove legacy credentials in the Danger Zone deletes them, and any client tenant still syncing through the legacy app stops syncing until it re-consents to your Client Access app.
Connection Test
Test legacy credentials checks those legacy values alone. The check for your own apps is Test Graph connection, in the menu on the Microsoft apps card at the top of the page.
Danger Zone
Disable Microsoft Integration stops sync and mail while keeping every credential. Remove legacy credentials deletes only the legacy shared-app values. Start Over forgets this portal's record of your app registrations so setup shows again, and asks you to type START OVER first. None of them deletes anything in your Microsoft tenant.
What we access & why
Every Microsoft Graph permission the two apps request, grouped by app, each with a plain sentence about what it is for.
Browse
On this page
Why it works this way: What the Microsoft Entra ID and Mail pages show
Setup is two steps: Connect Microsoft as Admin, then Run Azure App Creation. Prefer PowerShell? The same page can generate a script instead.
Client tenants are not granted here. Once the apps exist, each Microsoft client's own Overview page carries a Link & Consent banner, and a Global Administrator on that client's tenant approves it there.
Full Access and Send As are two different Microsoft permissions. Full Access lets the portal read a mailbox, and that is all the Authorize step can prove. Sending needs Send As or Send on Behalf, granted separately, which is why a mailbox can read Connected and still not send.
To connect a shared mailbox such as helpdesk@ or billing@, sign in with a real account that has been granted Full Access to it. In the Microsoft 365 admin center go to Recipients, then Mailboxes, open that mailbox, and add the signing-in account under Manage mailbox delegation. The classic Exchange admin center calls the same screen Mailbox delegation. Grant Send As or Send on Behalf there as well if that mailbox has to send, and give Microsoft a few minutes to apply a new grant before you retry Authorize.
Other ways to do this: What the Microsoft Entra ID and Mail pages show
Settings, Email, Mailbox & Sending
The same Help Desk, Billing and Training map, read-only, with a Change mail connection link to the Mail page.
Questions this page answers
How do I set up Microsoft 365 / Microsoft Entra ID?
Open the Microsoft Entra ID card. App creation (the MSP Runtime, Client Access, and Mail Auth apps) lives on that one page. Connect as an admin, then run app creation. Mailboxes are connected on the Mail page, at Admin > Integrations > Mail, once the apps exist. The Entra page shows a read-only "Mail Connections" card for Microsoft mailboxes only, with an "Open Mail" link. A forwarded mailbox is not shown there. Each client tenant's M365 access is then granted per client from their Overview page. If this page says some client tenants are still syncing through the legacy shared app, they keep syncing. To move one to your Client Access app, open that client's Overview and click Re-grant Consent in the Microsoft consent update available banner.
How do I connect a Microsoft 365 mailbox on the Mail page?
Open Admin > Integrations > Mail. If nothing is connected, click "Set up Microsoft 365". Find the "Mail Connections" card. Type the address you want to connect into "Mailbox to connect". For example, [email protected] or [email protected]. Then click "Authorize a Mailbox". Microsoft's sign-in screen opens next. Sign in with that exact account to connect it directly. Or sign in with a different account that has delegate access to it. Use that for a shared mailbox that has no sign-in of its own. See "How do I grant delegate access". Leave the field blank to connect the mailbox you sign in as. Once it is connected, assign the mailbox to a function in the same card. The functions are Help Desk, Billing, and Training. If the page says the Microsoft mail app is not set up yet, create it first on the Microsoft Entra ID page.
How do I grant delegate access to a shared mailbox (e.g. helpdesk@ or billing@) in Microsoft 365?
A shared mailbox like helpdesk@ or billing@ usually cannot sign in. So a real user account signs in for it. That account needs permission first. In the Microsoft 365 admin center, go to Recipients > Mailboxes. Open the shared mailbox. Under "Manage mailbox delegation", add the signing-in account with Full Access. This is required. It lets the portal read the mailbox. To let the portal send from it too, grant Send As or Send on Behalf. That is a different permission from Full Access. In the classic Exchange admin center, go to Recipients > Mailboxes > (the mailbox) > Mailbox delegation. A grant can take a few minutes to apply. Wait for it before the portal's Authorize step will work.
Was this helpful?