OAUTH access for TopView with Microsoft 365

OAUTH access for TopView with Microsoft 365

This article provides information on setting up access to email for TopView through a Microsoft 365 system.

TopView can leverage "Modern Authentication", or OAUTH, access to Microsoft 365 email systems. To facilitate access, TopView requires an account authorized to send email.

Scopes

To send/receive email, TopView must be authorized to access these resources. This is managed by granting TopView permissions through scopes in Azure Active Directory.

You can follow the directions from Microsoft to Authenticate an IMAP, POP or SMTP connection using OAuth | Microsoft Docs.

Here are the required scopes for TopView access and their justifications:
  1. https://outlook.office.com/IMAP.AccessAsUser.All - Provides IMAP access to TopView, used to check the email inbox
  2. https://outlook.office.com/SMTP.Send - Provides SMTP access to TopView, used to send email notifications
  3. offline_access - Allows TopView to request refresh tokens without user presence/interaction. This is necessary because we recommend running TopView as a Windows Service which does not allow user interactions.

Microsoft OAuth Client credentials flow for email access

TopView can leverage the Client Credentials flow which allows access to your corporate email via Microsoft Entra application instead of using the public MS365 API. The credentials supplied are a certificate or app secret generated within your application.

Follow the guidance in the Authenticate an IMAP, POP or SMTP connection using OAuth | Microsoft Learn article to set up this access, especially the section "Use client credentials grant flow to authenticate SMTP, IMAP, and POP connections".

The tenant and client information, as well as the generated credentials should be input into TopView Configurator's "Microsoft - Organization" sections of outgoing and incoming email settings.