Connect an organization-wide Outlook account with your own app registration

An organization-wide Outlook account can connect through an app registration you create in your own Microsoft Entra tenant, instead of through Tekst's published application. Tekst then signs in with your app's client ID and secret. There is no Microsoft sign-in or consent screen during the connection. Everything else about the organization-wide connection stays the same.

Who can do this

Creating the app registration does not need an administrator, but granting consent does. Without administrator rights, Microsoft Entra stops at this message:

"Consent for application permissions can only be performed by an administrator."

Do the whole setup as an administrator, or hand the consent step to one.

Step 1: Register the app

1. In the Azure portal, go to Microsoft Entra ID > App registrations > New registration.
2. Enter a Name you will recognize.
3. Under Supported account types, select Single tenant only.
4. Leave Redirect URI empty and click Register.
5. On the Overview page, note the Application (client) ID and the Directory (tenant) ID.

Step 2: Add the permissions

1. Open API permissions > Add a permission > Microsoft Graph.
2. Choose Application permissions, not Delegated permissions.
3. Add Mail.ReadWrite, Mail.Send and MailboxSettings.Read, then click Add permissions.

4. Click Grant admin consent for your organization. Each row must read Granted for your organization.

The list already holds User.Read (Delegated). Entra adds it to every new app, so leave it.

Step 3: Create a client secret

1. Open Certificates & secrets > Client secrets > New client secret.
2. Enter a description, pick an expiry and click Add.
3. Copy the Value right away. Entra shows it in full only once. The Secret ID is not the secret.

Note the date in the Expires column as well. You can enter it in Tekst in the next step.

Step 4: Connect in Tekst

1. In Tekst, open Integrations from the navigation menu.
2. Click Connect Integration in the top-right corner.
3. Click Connect on the Outlook card.
4. Select Organization-wide Outlook account and click Next.
5. On the Service Account step, select Your own app registration.
6. Enter the Directory (tenant) ID, the Application (client) ID and, under Client secret, the secret Value from the steps above.
7. Optionally, enter the date from the Expires column under Secret expiry date.
8. Click Connect Service Account.

Tekst signs in with your app before it saves anything. If Microsoft refuses the sign-in, Tekst shows "Failed to connect" with the reason:

• "Invalid client secret. Copy the secret's Value from Entra, not its Secret ID." The secret was pasted incompletely, or the Secret ID was pasted instead of the Value.
• "The client secret has expired." Create a new secret as in Step 3.
• "App not found in this tenant." The client ID and the tenant ID do not belong together. Copy both from the app's Overview page.
• "Tenant not found." Check the tenant ID.

The sign-in does not test the mail permissions from Step 2. If they are missing, the connection still completes, but the mailboxes you add show as Disconnected.

Continue with the Mailboxes and Email History steps, as described in Steps 3 and 4 of Connect an organization-wide Outlook account.

Step 5: Restrict Tekst to specific mailboxes (recommended)

A new app can reach every mailbox in your tenant until you scope it. Follow Restrict Tekst to specific mailboxes, and use your own app's Application (client) ID everywhere that article gives Tekst's ID.

You can also skip the Entra permissions in Step 2 and assign the same three permissions with Exchange RBAC for Applications, scoped to the mailboxes Tekst needs. Don't do both. Permissions granted in Entra cover every mailbox, so a scope on top of them has no effect.