10.11. Connect Microsoft 365 Inbound Email to Create Tickets

Most MSPs run their service desk through a shared mailbox such as support@yourmsp.com. This guide connects that Microsoft 365 (Exchange Online) mailbox to AlgaPSA. Once connected, AlgaPSA watches the mailbox and turns each new message into a ticket on the board you choose.

A connected Microsoft mailbox can now send as well as receive.

Connecting a mailbox sets up inbound ticket creation. Once connected, that same mailbox can also be selected as your outbound provider, so ticket replies and notifications go out through Microsoft Graph, are saved to the mailbox's Sent Items, and keep their reply-threading headers. Outbound sending through Microsoft 365 requires Pro; SMTP and managed email domains remain available on every plan. See Set up outbound email below.

This guide covers inbound email for ticket creation. To sync Microsoft 365 users into AlgaPSA contacts instead, see Sync Microsoft Entra Tenants and Contacts. That is a separate integration.

The examples below use a fictional MSP, Northwind MSP, connecting its support mailbox support@northwindmsp.com.

Prerequisites

1. AlgaPSA access: You are an administrator with permission to manage system settings.
2. Edition: Microsoft 365 inbound email is an Enterprise Edition feature. It is included on the self-hosted appliance and on hosted AlgaPSA. Community Edition builds do not offer this provider type.
3. A mailbox to connect: A licensed user mailbox, or a shared mailbox that the authorizing user can read.
4. Microsoft Entra access: Permission to create an app registration in your Microsoft Entra tenant.
5. A publicly reachable server, or polling: Microsoft Graph delivers new-mail notifications to https://<your-host>/api/email/webhooks/microsoft, which requires your AlgaPSA base URL to be reachable from the internet. If it cannot be — on-premise or restricted-network installs — run the provider in polling mode instead, which needs no inbound connectivity.

Step 1: Choose how AlgaPSA reaches Microsoft

Connecting a Microsoft mailbox is a guided setup. It opens by asking how AlgaPSA should authenticate, and there are three answers:

The automated path

The automated path provisions everything the connection needs, then asks a tenant administrator to consent on exactly the permissions it declares — nothing broader. Review the consent screen before approving; the permissions it requests are the ones listed below and no others.

Choose this unless you have a specific reason not to. Most Microsoft email connection problems come from a hand-registered app with a mistyped redirect URI or a missing permission.

Registering the app yourself

If you are pasting your own credentials, create the registration first.

1. Open the Microsoft Entra admin center and create an App registration.
2. Set the sign-in audience to allow multi-tenant sign-in ("Accounts in any organizational directory"). AlgaPSA authorizes through the Microsoft common endpoint.
3. Add a redirect URI of type Web: https://<your-host>/api/auth/microsoft/callback. The Providers screen in AlgaPSA shows the exact value to copy.
4. Under API permissions, add the delegated Microsoft Graph permissions Mail.Read, Mail.Read.Shared, and offline_access. These grant read-only mail access.
5. If you also want this mailbox to send (Pro), add Mail.Send. Without it the mailbox will connect and receive normally, but will not be selectable as an outbound provider.
6. Create a client secret and copy its value. Also note the Application (client) ID and, optionally, the Directory (tenant) ID.

Step 2: Save the credentials as a provider profile

1. In AlgaPSA, navigate to Settings > General in the sidebar to open Admin Settings, then select Integrations (under Data & Integration) and open the Providers tab.
2. In the Microsoft section, click New Profile.
3. Enter a display name, the Client ID, the Tenant ID (or leave it as common), and the Client secret. If this is your only Microsoft profile, mark it as the default.
4. Bind the profile to the Email consumer in the consumer bindings section on the same screen.

Credentials are entered only on this screen. The email provider form in the next step does not ask for a client ID or secret, and its Authorize Access button stays disabled until a profile is bound to the Email consumer.

Step 3: Add the mailbox as an inbound provider

1. Navigate to Settings > General in the sidebar to open Admin Settings, then select Email (under Communication) and open the Inbound Email tab.
2. Click Add Email Provider and choose Microsoft 365.
3. Fill in the form:

1. Click Authorize Access and complete the Microsoft sign-in and consent in the popup. Sign in with an account that can read the mailbox.

The popup closes on its own. AlgaPSA stores the tokens, registers a Microsoft Graph webhook subscription, and shows the provider as connected. New email in the mailbox now becomes tickets.

How the connection behaves

• By default, Microsoft Graph pushes a notification to AlgaPSA when new mail arrives.
• Graph subscriptions are short-lived, roughly 60 hours. AlgaPSA renews them automatically in the background and recreates them if Microsoft reports them gone. Renewal requests are capped to Microsoft's maximum permitted expiry.
• Inbound processing does not modify the mailbox. AlgaPSA does not mark messages as read or move them.

Operational check: After connecting, send a test email to the mailbox and confirm a ticket appears on the configured board within a few minutes.

Delivery mode: webhook or polling

Each Microsoft provider card shows a Delivery field with one of two values:

Polling-only mode exists for on-premise and restricted-network installs where Microsoft cannot reach your AlgaPSA host — the publicly reachable server listed in the prerequisites is a webhook requirement, not a polling one. Mail still becomes tickets; it simply arrives up to three minutes later.

Pausing an inbox

An inbound mailbox can be paused and resumed from the provider card. Pausing tears down the provider subscription, so nothing is delivered while it is paused; resuming re-establishes it. A paused provider carries a Paused badge in the list.

Pause an inbox when you are testing routing rules, migrating a mailbox, or working through a backlog you do not want turned into tickets. Tenant suspension pauses inbound email automatically and restores it when the tenant resumes.

Set up outbound email

Connecting the mailbox sets up receiving. Sending is configured separately, and as of 1.4 you have three options:

Sending through the connected mailbox

Select the connected Microsoft mailbox in Outbound Email. Ticket replies and notifications then go out through Microsoft Graph, with two useful consequences:

• Messages are saved to the mailbox's Sent Items, so your team sees the full conversation in Outlook, not just the half the client sent.
• Reply-threading headers are preserved, so client replies thread back onto the original ticket rather than opening a new one.

This requires the Mail.Send permission. If the mailbox was connected before you added it, re-authorize the provider so consent covers sending.

For the other two options, see Set Up Outbound Email over SMTP and Set Up a Custom Outbound Email Domain.

Whichever you choose, set the Ticketing From address to the same address as the connected mailbox, for example support@northwindmsp.com. See Configure Ticket Reply-To Email.

Troubleshooting

• "Authorize Access" is disabled, or the form warns about provider settings. No Microsoft profile is bound to the Email consumer yet. Navigate to Settings > General in the sidebar to open Admin Settings, then select Integrations (under Data & Integration), open the Providers tab, and create and bind a profile first (Step 2).
• The Microsoft sign-in popup fails. Confirm the redirect URI in the form exactly matches the one registered in the Entra app, and that the app allows multi-tenant sign-in.
• The mailbox is connected but is not offered as an outbound provider. Outbound sending through Microsoft 365 requires Pro and the Mail.Send permission. Add the permission in Entra and re-authorize the provider so consent covers sending.
• Incoming mail is not creating tickets. First check whether the inbox is Paused — a paused provider has no subscription and receives nothing. Otherwise check the provider's subscription health in the provider list and use the retry-renewal action. Also confirm your base URL is publicly reachable, since Microsoft pushes notifications to /api/email/webhooks/microsoft. If it cannot be, switch the provider to polling delivery.
• Mail arrives a few minutes late. The provider is in polling mode, which checks every three minutes. This is expected; switch to webhook delivery if your host is publicly reachable.
• The wrong folder is being watched. Adjust Folder Filters on the provider and save again. Each watched folder gets its own subscription.

Related topics

• Set Up Outbound Email over SMTP — required before AlgaPSA can send ticket replies and notifications.
• Configure Ticket Reply-To Email — thread client replies back onto tickets.
• Sync Microsoft 365 and Google Workspace Inbound Email — inbound ticket defaults and provider management.
• Sync Microsoft Entra Tenants and Contacts — a separate integration that syncs Microsoft 365 users into contacts.