M365 Oauth Remote Mailbox help

JShermanREX

Hello,

New to OS Ticket. Running 1.18.4 on debian 13 under apache. PHP is 8. All required extensions are installed and loaded correctly except for imap (I think I read somewhere this extension is no longer used for standard imap retrieval).

I have Oauth setup and working for agent logins. The enterprise app is created in M365, has all the required permissions per this article (https://docs.osticket.com/en/latest/OAuth2/Microsoft%20Authorization%20Guide.html). And has been granted admin consent for the company.

The system seems to be working. So now I am trying to setup incoming email. We are an M365 house so I have setup a shared mailbox (ittest@company.com) and I have setup a service account for OS Ticket (servicesosticket@company.com). I added send as and full control permissions for the service account to the shared mailbox. I checked via Outlook web in an in-private browser session and I can login as the service account and access the shared mailbox. I see the 2 emails I sent it without issue.

I then go to add the email to OSTIcket and connect to the remote mailbox. Again, using the instructions in the link above I set that up in an in-private browser set authentication to Oauth2 - Microsoft and go through the auth setup making sure to uncheck "Strict Matching". Is authenticates without issue, I get the green success message. And I go to complete the remote mailbox settings (hostname, port number, protocol, and turn on remote fetching) and when I save changes I get a really generic authentication error and it won't save.

KevinTheJedi

JShermanREX

That likely means the service account doesn’t actually have full send as and read and manage permissions to the mailbox, you are not using the right Scopes, or maybe IMAP is not enabled on the account/tenant level.

Cheers.

JShermanREX

Thank you for the reply. Based on your reply I did an additional test. I setup the email address for the service account in OSTicket and auth'd it using the same setup as the shared mailbox. It worked as expected. After the auth I was able to fill in the hostname and port and such and it saved without issue. So that leads me to think, as you mentioned, that the service account does not have the proper access to the shared mailbox, but I am confused because it has full access permissions in Exchange Online, and in Outlook web I can use the service account to access the shared mailbox. It seems the service account cannot access the shared mailbox through IMAP but it can access it's own mailbox through IMAP. Or something else crayz going on. Any thoughts?

KevinTheJedi

JShermanREX

Check the shared mailbox's outlook settings to ensure IMAP is enabled. Also ensure it's enabled on the account from the admin-side (admin settings can trump individual mailbox settings). In the Admin Center find the shared mailbox account in either the user list or the shared mailbox section, find the mailbox permissions (or members list), and check the Send As/Read and Manage permissions to ensure the service account is listed and has the needed access.

Cheers.

JShermanREX

KevinTheJedi
Hello, Thanks again for the reply.

While I was waiting for your reply I actually checked all of that. Checked IMAP and SMTP on the shared mailbox, they are set to inherit from the tenant. Checked the tenant settings and they are both enabled. And yes checked the shared mailbox permissions and confirmed the service account has send as and full control.

Honestly lost here. I can get it working for the direct mailbox of the service account but not a shared mailbox using the service account for auth.

KevinTheJedi

JShermanREX

That is quite strange.. we have hundreds if not thousands of people using O365 shared mailboxes through OAuth2 authorization. I'm sure there is something going on on the account level or maybe even tenant level. I would contact your O365 admin for further assistance. They would be able to check logs, etc. to see what's going on with the auth attempts as well as if it has appropriate perms, etc.

Cheers.

JShermanREX

Sadly, I am the O365 Admin... I have checked the auth logs in Entra. Strangely they don't show anything happening at all when I try to do the "Save" for the hostname and port. It shows a log every time I do the config and that shows all good. And OSTicket seems to agree because it saves the token. I have tried turning logging up in OSTicket but nothing ever seems to appear in the log for this. Is there a way to see the interchange with MS more closely?

KevinTheJedi

JShermanREX

Through modifying the code (look in include/class.email.php -> MailBoxAccount::getMailbox(), include/class.mail.php -> MailBoxProtocolTrait::init(), and even include/laminas-mail/src/Protocol/Imap.php) or inspecting your server’s network traffic. Sometimes the errors can be misleading as they can be generalized for certain exceptions/errors.

To check the auth attempts on Microsoft’s end (which is the easiest route) Google says:

1. Login to Microsoft Entra Admin Center as global or security admin
2. Navigate to Identity > Monitoring & health > Sign-in logs
3. Switch to the Non-interactive user sign-in logs tab (since IMAP/POP requests typically register as non-interactive).
4. Filter or search by the affected User or check the Client app column for protocols like IMAP or Authenticated SMTP.

You said you confirmed IMAP succeeds using OAuth2 with the service account address, right? So you setup the auth, got a working token (confirmed in Token tab in the auth Config popup), setup the hostname/port number, set the Status to Enable, and Saved Changes successfully? Of so then that would rule out host connection issues, likely firewall issues, port restrictions, etc.

Did you add the proper Graph - delegated permissions including imap, offline_access, and the others and then provide admin consent to all of them in the app registration in azure?

You confirmed IMAP is enabled on the shared mailbox in outlook and via the admin center? You also ensured there are zero IMAP restrictions on the shared mailbox from the admin-side?

Cheers.

JShermanREX

KevinTheJedi

Hello,

Yes, I can confirm that using the service account's email address I was able to setup another email address in OSTicket, auth it with OAuth, got the token, set the hostname, port, etc, saved that, sent it an email, and saw a ticket get created. Then went to do the exact same thing using the service account to auth the shared mailbox and got the errors I screenshotted above.

Yes, all the permissions are applied to the app registration in Azure, I asusme that would need to be there for the service account test to have worked.

Yes I confirmed IMAP is enabled on the shared mailbox using powershell, the mailbox's setting is blank, research tells me that is inheriting from the tenant, which is set to allow IMAP (as evidenced in the test with the service account).

KevinTheJedi

JShermanREX

Then I have no idea. Everything seems to be correct. I’d contact ms support to see if they can shed some light. Tested with mine and it’s working.

Cheers.