# Microsoft 365 administrator checklist

Approve the exact Bow Chat Outlook application and check Exchange Online mailbox, consent, IMAP, and OAuth SMTP policy.

Use this checklist for the licensed user mailbox your organization wants to connect to Bow Chat. An Exchange administrator handles mailbox settings; a Cloud Application Administrator or another authorized consent administrator reviews the enterprise application.

## 1. Confirm mailbox and policy

Confirm that the address is a **UserMailbox** with an active Exchange Online licence. If it is **SharedMailbox**, use the [shared-mailbox guide](https://docs.bow.chat/email/microsoft365-shared).

Bow Chat currently receives with OAuth IMAP and sends with OAuth SMTP AUTH. **Microsoft Security Defaults disables SMTP AUTH**, including this route. A mailbox SMTP switch does not override Security Defaults. If your policy requires Security Defaults or otherwise forbids these protocols, this connector is unsuitable under that policy. Keep the policy and resolve the transport requirement before onboarding; do not enable Basic authentication or use app passwords. See [Microsoft's SMTP AUTH settings](https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission).

## 2. Approve the exact application

| Field | Expected value |
|---|---|
| Application | Bow Chat Outlook |
| Application/client ID | `0c3ba48e-4432-4f52-bb62-a613364eebbd` |
| Delegated Exchange permissions | `IMAP.AccessAsUser.All`, `SMTP.Send` |
| Sign-in and renewal scopes | `openid`, `profile`, `email`, `offline_access` |

Review the published [Bow Chat Privacy Policy](https://bow.chat/privacy-policy) and [Terms and Conditions](https://bow.chat/terms-and-conditions) before approval. Microsoft’s current consent screen does not display these policy links.

In **Entra ID → Enterprise apps → All applications**, find the app and verify its client ID. Open **Security → Permissions**, review the requested access, and use **Grant admin consent** if approved. Publisher verification is pending; follow your organization's unverified-app review policy. Do not create a replacement app registration or client secret.

If the app is absent, an authorized administrator can [provision the existing multitenant application's enterprise app](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/create-service-principal-cross-tenant) using Azure CLI:

```sh
az login --tenant <CLIENT_TENANT_ID> --allow-no-subscriptions
az ad sp create --id 0c3ba48e-4432-4f52-bb62-a613364eebbd
```

Check for the existing app before creation. Provisioning is followed by permission review and consent in the portal. Under **Properties**, require user assignment where supported by your tenant, then assign only approved mailbox users under **Users and groups**. Review applicable Conditional Access policies. [Microsoft consent guidance](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent).

## 3. Enable only the selected mailbox

In **Microsoft 365 admin center → Users → Active users → selected user → Mail → Manage email apps**, enable **IMAP** and **Authenticated SMTP**, if your security policy permits them. Save and read the settings back.

Equivalent Exchange Online PowerShell, after connecting as the authorized Exchange administrator:

```powershell
Connect-ExchangeOnline -UserPrincipalName <ADMIN_UPN>
Get-Mailbox -Identity <MAILBOX_UPN> | Format-List RecipientTypeDetails
Get-CASMailbox -Identity <MAILBOX_UPN> | Format-List ImapEnabled,SmtpClientAuthenticationDisabled
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity <MAILBOX_UPN> -ImapEnabled $true -SmtpClientAuthenticationDisabled $false
Get-CASMailbox -Identity <MAILBOX_UPN> | Format-List ImapEnabled,SmtpClientAuthenticationDisabled
```

Expected mailbox results: `ImapEnabled: True`, `SmtpClientAuthenticationDisabled: False`. Leave other mailboxes' and organization-wide settings unchanged. These values do not prove Security Defaults or other policy permits the connection. [IMAP settings](https://learn.microsoft.com/en-us/troubleshoot/exchange/user-and-shared-mailboxes/pop3-imap-owa-activesync-office-365).

## 4. Connect and accept

The actual mailbox user now follows [Connect Microsoft 365](https://docs.bow.chat/email/microsoft365), including MFA. Granting tenant consent does not connect a mailbox, and an unlicensed admin account cannot stand in for one. Confirm incoming mail, a reply received externally, and continued operation after access renewal before moving live service traffic.

Canonical: https://docs.bow.chat/email/microsoft365-admin
Version: 4
Updated: 2026-10-17T13:47:08.630Z