Configure Custom SMTP OAuth for Microsoft Exchange Online

Use these instructions to configure ShareFile Custom SMTP with OAuth authentication for Microsoft Exchange Online.

For additional information, see Microsoft's documentation about SMTP application RBAC onboarding.

Before you begin

• You need an employee user with the Allow this user to modify account-wide policies permission.
• You need access to Microsoft Entra ID and Exchange Online PowerShell.
• The mailbox you use as the SMTP identity must be included in the RBAC management scope.

Set up your Microsoft Entra ID application

1. Register a new application in Microsoft Entra ID.

   Do not add permissions to the application. This configuration does not require claims.

2. Create a client secret:

   1. Open your new application.
   2. Select Certificates & secrets.
   3. Select the Client secrets tab.
   4. Select New client secret.
   5. Enter a description and expiration, then select Add.
   6. Save the generated secret Value in a secure location. This value is displayed only once.

Configure the Exchange Online RBAC policy

You must use the Exchange Online PowerShell module because these operations are not available in the Exchange admin center.

1. Install the ExchangeOnlineManagement PowerShell module and authenticate to your tenant.

   powershell

   Install-Module -Name ExchangeOnlineManagement
   Import-Module -Name ExchangeOnlineManagement
   Connect-ExchangeOnline -Organization <Organization/tenant ID>

2. Create a service principal for your Entra ID application.

   powershell

   New-ServicePrincipal -AppId <Client application ID> -ObjectId <Object ID> -DisplayName <Name>

   The Application (client) ID and Object ID appear on the Overview page of the Enterprise Application in Entra ID.

3. Create a management scope that includes the mailbox used as the SMTP sender.

   powershell

   New-ManagementScope -Name "RBAC Scope" <Filter properties>

   See Microsoft's documentation about management role scopes for supported filters.

4. Assign the Application SMTP.SendAsApp role to the service principal.

   powershell

   New-ManagementRoleAssignment -Name RBAC -Role 'Application SMTP.SendAsApp' -App <App ID> -CustomResourceScope <Management scope name>

5. Verify that SMTP AUTH is enabled for your mailbox. For instructions, see Enable SMTP AUTH for specific mailboxes.

Configure ShareFile Custom SMTP

1. In ShareFile, go to Account Settings > Advanced Preferences > Email Settings > Configure SMTP Settings.
2. In the Authentication Method list, select Microsoft Exchange Online.
3. Enter the Tenant ID. This is the Directory (tenant) ID on your Entra ID application's Overview page.
4. Enter the Client ID. This is the Application (client) ID on your Entra ID application's Overview page.
5. Enter the Client Secret. Use the secret Value that you saved when you created the client secret.
6. Enter the Email address for the mailbox included in the RBAC management scope. Notifications are sent from this address.
7. For Server, enter smtp.office365.com.
8. For Port, enter 587 (recommended) or 25.
9. For Notify email on failure, enter a valid email address.
10. For Security Setting, select TLS over Port 587. This setting corresponds to Explicit/STARTTLS.
11. Select Save and send test email.

If the configuration succeeds, you receive an email with the subject ShareFile Custom SMTP Configuration Test. If it fails, you receive an email with the subject [FAILURE] ShareFile Custom SMTP Configuration Test that includes error details.