Microsoft 365 administrator checklist
Approve the exact Bow Chat Outlook application and check Exchange Online mailbox, consent, IMAP, and OAuth SMTP policy.
Use this checklist for the licensed user mailbox your organization wants to connect to Bow Chat. An Exchange administrator handles mailbox settings; a Cloud Application Administrator or another authorized consent administrator reviews the enterprise application.
1. Confirm mailbox and policy
Confirm that the address is a UserMailbox with an active Exchange Online licence. If it is SharedMailbox, use the shared-mailbox guide.
Bow Chat currently receives with OAuth IMAP and sends with OAuth SMTP AUTH. Microsoft Security Defaults disables SMTP AUTH, including this route. A mailbox SMTP switch does not override Security Defaults. If your policy requires Security Defaults or otherwise forbids these protocols, this connector is unsuitable under that policy. Keep the policy and resolve the transport requirement before onboarding; do not enable Basic authentication or use app passwords. See Microsoft's SMTP AUTH settings.
2. Approve the exact application
| Field | Expected value |
|---|---|
| Application | Bow Chat Outlook |
| Application/client ID | 0c3ba48e-4432-4f52-bb62-a613364eebbd |
| Delegated Exchange permissions | IMAP.AccessAsUser.All, SMTP.Send |
| Sign-in and renewal scopes | openid, profile, email, offline_access |
Review the published Bow Chat Privacy Policy and Terms and Conditions before approval. Microsoft’s current consent screen does not display these policy links.
In Entra ID → Enterprise apps → All applications, find the app and verify its client ID. Open Security → Permissions, review the requested access, and use Grant admin consent if approved. Publisher verification is pending; follow your organization's unverified-app review policy. Do not create a replacement app registration or client secret.
If the app is absent, an authorized administrator can provision the existing multitenant application's enterprise app using Azure CLI:
az login --tenant <CLIENT_TENANT_ID> --allow-no-subscriptions
az ad sp create --id 0c3ba48e-4432-4f52-bb62-a613364eebbd
Check for the existing app before creation. Provisioning is followed by permission review and consent in the portal. Under Properties, require user assignment where supported by your tenant, then assign only approved mailbox users under Users and groups. Review applicable Conditional Access policies. Microsoft consent guidance.
3. Enable only the selected mailbox
In Microsoft 365 admin center → Users → Active users → selected user → Mail → Manage email apps, enable IMAP and Authenticated SMTP, if your security policy permits them. Save and read the settings back.
Equivalent Exchange Online PowerShell, after connecting as the authorized Exchange administrator:
Connect-ExchangeOnline -UserPrincipalName <ADMIN_UPN>
Get-Mailbox -Identity <MAILBOX_UPN> | Format-List RecipientTypeDetails
Get-CASMailbox -Identity <MAILBOX_UPN> | Format-List ImapEnabled,SmtpClientAuthenticationDisabled
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity <MAILBOX_UPN> -ImapEnabled $true -SmtpClientAuthenticationDisabled $false
Get-CASMailbox -Identity <MAILBOX_UPN> | Format-List ImapEnabled,SmtpClientAuthenticationDisabled
Expected mailbox results: ImapEnabled: True, SmtpClientAuthenticationDisabled: False. Leave other mailboxes' and organization-wide settings unchanged. These values do not prove Security Defaults or other policy permits the connection. IMAP settings.
4. Connect and accept
The actual mailbox user now follows Connect Microsoft 365, including MFA. Granting tenant consent does not connect a mailbox, and an unlicensed admin account cannot stand in for one. Confirm incoming mail, a reply received externally, and continued operation after access renewal before moving live service traffic.