Organization Email Service
Open Settings → Email to choose how Organization mail is sent. The connection covers invitations, Outbox review notifications, and agents using default platform addresses. An agent's explicitly connected mailbox takes precedence. Account sign-in, verification, and recovery continue using platform email.
Owner, Admin, and Security Admin can change the connection and send tests. Agent Admin can view it and change agent email policy. Auditor has read access.
Choose the sending service
| Choice | Use it for |
|---|---|
| Use platform email | Inherit the deployment's delivery service |
| Microsoft 365 — your own application | Send through your Organization's Exchange Online mailbox using an application credential |
| Custom SMTP relay / Exchange Server | Send through an authorized SMTP relay, including a configured private Exchange Server |
The Organization sender address replaces the From address for default-agent mail while preserving the agent's display name. Replies use the existing agent address unless you set an Organization reply-to. Keep that inbound route working: this connection sends mail and does not create mailboxes, DNS records, or inbound routing.
Connect Microsoft 365
This Organization connection uses an application credential. For an individual agent's interactive mailbox connection, use Connect Outlook in its Email Settings instead.
- Have your Microsoft administrator register a single-tenant application in the mailbox's Microsoft cloud. Obtain the tenant ID, application ID, and a client secret value or certificate and matching private key.
- Have an Exchange administrator grant Application Mail.Send through Application RBAC, scoped to the sender mailbox. Test the intended mailbox and one outside the scope. Exchange RBAC and Entra grants are additive, so a separate unrestricted Entra mail grant can defeat that scope. Follow Microsoft's Application RBAC instructions.
- Select the cloud, enter the IDs and credentials, and set the sender mailbox. Commercial and GCC use the global Graph service; GCC High and DoD use their respective government endpoints. The app must belong to the selected cloud. See Microsoft's cloud endpoints.
- Save, then send a test and check its actual arrival.
Certificate authentication requires a valid PEM certificate and matching unencrypted RSA private key of at least 2048 bits. A client secret field takes the secret's value, not its identifier. Store either only in the protected settings fields.
This integration accepts MIME messages up to 4 MiB after base64 encoding, including attachments. Larger messages fail; use an appropriate file-sharing workflow instead. Graph acceptance indicates processing, not confirmed inbox delivery. See Microsoft's sendMail response semantics.
Connect an SMTP relay
Enter the relay hostname, port, sender, and transport security. For authenticated SMTP, supply both username and password. An IP-authorized relay can leave both empty.
A private relay first requires the deployment operator to configure allowed and denied private network ranges. Enter a narrower approved range in Private relay networks (CIDRs). A custom CA bundle replaces system trust for this connection; the certificate must still match the relay hostname. Unencrypted SMTP is limited to approved private relays without password authentication.
Ask the operator to confirm network access and relay authorization before testing. Organization settings cannot authorize access to arbitrary internal hosts.
Save, test, and rotate
Saving activates the settings for subsequent sends; it does not send a test. Send test email uses the saved revision and sends to the signed-in administrator, with at least 30 seconds between tests. Review the test result and last delivery attempt, then verify inbox arrival or provider message trace.
A configured service failure is reported without silently falling back to platform mail. Check delivery before retrying an ambiguous send to avoid duplicate messages.
Blank credential fields preserve saved values. Use the explicit removal control to clear one. Changing provider removes the old provider's credentials; saving Use platform email removes all Organization email credentials. Changing Microsoft tenant, app, or cloud requires fresh credentials. SMTP connection changes may likewise require re-entering the password.
For certificate rotation, register the replacement in Microsoft first, replace the certificate and key together, save and test, then retire the previous certificate after in-flight sends finish. If another administrator changed the settings meanwhile, reload and review the latest version before saving again.
Set email review policy
The same screen controls the default sending mode for new agents and an optional minimum review requirement. Applying the default to existing agents is a separate opt-in. Agents may use stricter review, including when they have their own connected mailboxes.
These controls require the deployment's email-review feature to be available; saving policy does not enable the feature itself. Use Review Before Send for the Outbox workflow and recipient permissions.