Settings

Users

Only people listed here can sign in (with the Microsoft 365 address they sign in with). viewer can read, editor can also add, change, import and delete data, admin can also change settings and users. You cannot change your own role.

EmailNameRoleActiveLast sign-in

Office 365 connection (Microsoft Graph)

These values are set on the server in the .env file (or the server's protected environment), never in this page. The client secret is never shown or stored in the database.

Tenant IDGRAPH_TENANT_ID
Client IDGRAPH_CLIENT_ID
Client secretGRAPH_CLIENT_SECRET
Checks sign-in, granted permissions, and read access to each active mailbox. Sends no email.

Mailboxes the application may use

Only addresses listed here and active are used. The Microsoft side must also be restricted to the same mailboxes (see the setup steps below).

NameEmailActive

How to set it up on the Microsoft side

Short version below; full details and troubleshooting are in docs/office365-setup.md. You need a Microsoft 365 / Entra administrator account.

1. Register the application
  1. Go to entra.microsoft.com → Identity → Applications → App registrations → New registration.
  2. Name: Mailings. Supported account types: Single tenant. No redirect URI. Register.
  3. On the Overview page copy Directory (tenant) ID and Application (client) ID into .env.
2. Give it mail permissions
  1. API permissions → Add a permission → Microsoft Graph → Application permissions.
  2. Add Mail.Send and Mail.ReadWrite (use Mail.Read instead if replies should only be read).
  3. Click Grant admin consent for your organisation. Both rows must show a green check.
3. Create a client secret
  1. Certificates & secrets → New client secret → pick an expiry (e.g. 12 months).
  2. Copy the Value immediately (it is shown only once) into GRAPH_CLIENT_SECRET in .env. Put a reminder in your calendar before it expires.
4. Restrict the app to the two mailboxes (important)

Application permissions normally reach every mailbox in the organisation. Limit them in Exchange Online PowerShell:

  1. Create a mail-enabled security group (e.g. mailings-allowed@paradisskolekorps.no) containing only the approved mailboxes.
  2. New-ApplicationAccessPolicy -AppId <client id> -PolicyScopeGroupId mailings-allowed@paradisskolekorps.no -AccessRight RestrictAccess -Description "Mailings app"
  3. Test-ApplicationAccessPolicy -Identity programm@paradisskolekorps.no -AppId <client id> should say Granted; a mailbox outside the group should say Denied.
  4. The policy can take up to an hour to take effect.
5. Apply and test
  1. Save .env, then on the server run docker compose up -d (local) or restart the web service so the values are loaded.
  2. Reload this page and press Test connection.