---
title: "Microsoft Graph"
slug: "microsoft-graph"
updated: 2026-08-20T15:05:51Z
published: 2026-08-20T15:05:51Z
canonical: "docs.processmaker.com/microsoft-graph"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.processmaker.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Graph

The **Microsoft Graph Mail Driver** allows to send email through the Microsoft Graph API using OAuth 2.0 client credentials. This driver uses application permissions instead of delegated user permissions, so it does not require browser authorization, refresh tokens, stored tokens, or the **Authorize Account** flow.

Unlike the Office 365 SMTP implementation, which authenticates through SMTP, the Microsoft Graph Mail Driver sends email through the Microsoft Graph `sendMail` endpoint.

---

## Configure Office 365 Mailer Driver Settings

**Permissions**

Your user account or group membership must have the "Settings: Update Settings" permission to edit email server settings unless your user account has the **Make this user a Super Admin** setting selected.

See the [Settings](/v1/docs/permission-descriptions-for-users-and-groups#settings) permissions or ask your Administrator for assistance.

### Enable Office 365 SMTP OAuth in Email Server Settings

Follow these steps to enable SMTP authentication for the Office 365 email server settings. [Create a new email server configuration](/v1/docs/email-default-settings#create-a-new-email-server-configuration). Email server settings display.

| Configuration | Value |
| --- | --- |
| Mail Driver | Microsoft Graph |
| Authentication | OAuth Client Credentials |
| Permission Type | Application |
| Transport | Microsoft Graph REST API |
| Refresh Tokens | No |
| Authorization Account | Not required |
| Validation | Send test email |

## Required Configuration

When the Microsoft Graph driver is selected, configure the following settings:

| Setting | Description |
| --- | --- |
| Tenant ID | Microsoft Entra tenant ID used to request the access token. |
| Client ID | Application client ID from the Microsoft Entra app registration. |
| Client Secret | Application client secret used with the client credentials flow. |
| Sender Email | Mailbox address used to send email through Microsoft Graph. |
| Sender Name | Display name used for outgoing messages. |

These values are loaded into the runtime configuration before email is sent.

## Required Microsoft Entra Configuration

Before using Microsoft Graph as a mail driver, register an application in **Microsoft Entra ID** and configure the required application permissions.

The application must have the following Microsoft Graph permission:

| Microsoft Graph Permission | Type | Required | Purpose |
| --- | --- | --- | --- |
| `Mail.Send` | Application | Yes | Allows the application to send email through Microsoft Graph without a signed-in user. |

No delegated permissions are required because the driver uses the OAuth 2.0 Client Credentials flow.

## Authentication Behavior

The Microsoft Graph Mail Driver uses the OAuth 2.0 Client Credentials flow. Before sending an email, ProcessMaker requests an access token from Microsoft using the configured Tenant ID, Client ID, and Client Secret.

Because this is application authentication:

- No browser authorization is required.
- No refresh tokens are issued.
- No tokens are stored in ProcessMaker.
- A new access token is requested each time an email is sent.
- If required credentials are missing, delivery stops before the email is sent.

## Sending Email

Email delivery uses the same entry points as other mail drivers, including process execution through `SendEmail` and the existing test email function.

When an email is sent, the Microsoft Graph transport:

1. Requests an OAuth access token.
2. Converts the email into the Microsoft Graph `sendMail` payload.
3. Sends the request to:

```plaintext
POST /v1.0/users/{senderEmail}/sendMail
```

Any non-success response from Microsoft Graph results in a transport error.

## Message Conversion

The Send Email connector builds a standard email message, and the Microsoft Graph transport converts that message into the JSON format required by Microsoft Graph.

The conversion includes:

- Subject
- HTML or text body
- To recipients
- CC recipients
- BCC recipients
- Attachments

Attachments are converted into Microsoft Graph `fileAttachment` objects. Because Microsoft Graph expects attachments to be included in the JSON request using Base64-encoded raw bytes, attachment content is taken from the attachment body before encoding.

## Test Email Validation

Use **Send Test Email** to validate the Microsoft Graph configuration. Unlike Office 365 SMTP, there is no authorization step.

A successful test email confirms that:

- Azure credentials are valid.
- Application permissions have been granted.
- The sender mailbox exists.
- The application is allowed to send mail as the configured mailbox.