Skip to content
AskVault Docs
Try Free →

Outlook OAuth setup for email assistant

Written by Joseph Russo, Principal Architect, Networks and Tech, AskVault · Reviewed by Allison Chan
Last updated: · 3 min read

Why there is no password option

Microsoft has turned off password sign-in ("basic authentication") for Exchange Online IMAP and SMTP and for Outlook.com. Apps must use OAuth 2.0, so a password or App Password is refused even when it is correct. AskVault uses Microsoft sign-in for these mailboxes for that reason.

Two account types

  • Outlook.com, Hotmail and Live (personal). You sign in and approve AskVault yourself.
  • Microsoft 365 (work or school). Your organization may only let administrators approve apps. If so, Microsoft shows a "Need admin approval" screen and AskVault shows the same message when you return.

Connect your mailbox

About 5 minutes:

  1. Open Channels > Email and pick Outlook / Microsoft 365.
  2. Click "Connect with Microsoft". You go to Microsoft's sign-in page.
  3. Sign in with the support mailbox account you want AskVault to answer from.
  4. Review and accept the permissions (listed below).
  5. Back in AskVault, we check that we can read the inbox and send from the mailbox, then save it. If either check fails, nothing is saved and the page says what to fix.

AskVault starts answering new unread emails within 60 seconds. Tone, signature, escalation and the other email settings work the same as for any other mailbox.

Permissions requested

  • IMAP.AccessAsUser.All. Read the mailbox over IMAP, to fetch new emails and mark them read.
  • SMTP.Send. Send replies from the mailbox over SMTP.
  • offline_access. Keep the connection working without you signing in again every hour.
  • openid and email. Learn which mailbox address you signed in with.

AskVault does not request calendar, contacts, files or Microsoft Graph mail permissions.

For Microsoft 365 administrators

Two tenant settings commonly block the connection:

  1. App approval. If users can't consent to apps, approve AskVault for the organization in the Microsoft Entra admin center (Enterprise applications, then the AskVault app, then Permissions, then grant admin consent), or approve the request the user sends you.
  2. Authenticated SMTP. AskVault sends replies through SMTP submission, which Microsoft 365 can turn off for a mailbox or the whole organization. Turn on Authenticated SMTP for the support mailbox in the Microsoft 365 admin center (Users, Active users, the mailbox, Mail, Manage email apps). If it is off, sign-in works but AskVault shows "couldn't send email from this mailbox" and saves nothing.

IMAP must also be enabled for the mailbox (it is on by default).

Staying connected

  • Access tokens last about an hour. AskVault renews them before they expire.
  • Sign-in renewal. Each renewal also replaces the long-lived sign-in token, so a mailbox AskVault keeps checking stays connected. Microsoft can still end it early: a password change, an administrator revoking access, or a sign-in policy.
  • Reconnect required. If Microsoft stops accepting the sign-in, AskVault stops checking the mailbox and the Email page shows Reconnect required. Click Reconnect with Microsoft; your settings are kept.

Disconnect

Channels > Email > Disconnect removes the mailbox and deletes the stored sign-in from AskVault. To also remove AskVault from your Microsoft account, remove it from the apps that can access your account in your Microsoft account (personal) or My Apps (work or school) settings.

Common pitfalls

"Your Microsoft 365 administrator needs to approve AskVault". Your tenant blocks user consent. Ask an administrator to approve AskVault, then connect again.

"We could sign in but couldn't send email from this mailbox". Authenticated SMTP is off for the mailbox or the organization. See the administrator steps above.

Replies land in spam. Your domain is missing SPF, DKIM or DMARC records. AskVault shows their status on the Email page.

FAQ

Does this work with Hotmail.com or Live.com?

Yes. They are Outlook.com accounts and use the same Microsoft sign-in.

Can I connect multiple Outlook inboxes?

One mailbox per workspace. To answer several addresses, use one workspace per address.

Which emails does AskVault read?

New unread messages in the Inbox folder. Other folders are not checked.

Does this support shared mailboxes?

Not yet. AskVault signs in as the mailbox you choose on the Microsoft sign-in page, so connect a mailbox you can sign in to directly.

Is my sign-in stored safely?

The Microsoft tokens are encrypted at rest and never shown in the dashboard or returned by the API. Your Microsoft password is never seen by AskVault.

Was this page helpful?