Setup guide · for a Microsoft 365 administrator
One admin setup that connects all your practice’s email at once
Overview
A one-time setup that connects every mailbox in your agency at once — every member of staff, every shared mailbox, every address on your Microsoft 365 tenant. Nobody on your team signs in to anything, and nobody has to be asked.
CaseLoop signs in as the application itself, with no user account and no seat to pay for. There is no mailbox to share and no password to rotate for staff.
The three values go into the wizard on your own machine and are stored encrypted there. CaseLoop’s servers never receive them.
Delete the client secret and token minting stops immediately. Delete the app registration and all access stops with it.
This is the agency-wide setup. An administrator registers one application in your own Microsoft 365 tenant, and CaseLoop then reads every mailbox on it — every member of staff, every shared mailbox — without any of them signing in or knowing it happened.
If you only want CaseLoop to read your own mailbox, stop here. That takes about two minutes, needs no administrator and no app registration — see Connect your Outlook.
| Just my Outlook | Every mailbox in the agency — you are here | |
|---|---|---|
| What CaseLoop reads | Only your own mailbox | Every mailbox on the tenant |
| Who does the setup | You, right now | A Microsoft 365 administrator |
| How long it takes | About two minutes | About fifteen minutes |
| What you have to supply | Nothing — you just sign in | A tenant ID, a client ID and a client secret from an app you register |
| What your staff then do | Each person connects their own mailbox | Nothing at all |
| Sending and filing mail | Yes — as you, from your mailbox | No. This grant is read-only |
| The guide | Connect your Outlook | This one |
Mail.Read as an application permission reads every mailbox in the tenant by default. That is the blast radius of the client secret you are about to create — treat it as a top-tier secret. Step 6 shows how to narrow it to a single mail-enabled security group if you want to.
This path is read-only: an app-only registration with these two permissions cannot send, modify or delete mail. A mailbox connected individually is a different grant with different permissions — see Connect your Outlook.
Microsoft occasionally rearranges the Entra admin center; if something isn’t where this guide says, search for its name in the bar at the top.
Setup steps
Start in CaseLoop. The wizard shows the same five steps as this guide and carries the values forward for you, so keep both open.
In CaseLoop, open Email. If no mailbox is connected yet, the page asks “Which mailbox should CaseLoop read?” — below the provider choices, click Set up agency-wide mail instead. Choose Microsoft 365 on the first step.
If mail is already connected on this machine, the same wizard is under the Email page’s settings, on the Mailbox tab.
The wizard’s step rail reads Provider → Project → Credentials → Grant access → Finish. The five numbered steps below are those five, with the Entra work spelled out.
Open App registrations → New registration. Name it something recognisable. Leave the redirect URI blank — CaseLoop signs in as the application, not as a person.
On the app’s Overview page, copy the Application (client) ID and the Directory (tenant) ID. The next step asks for both.
| Name | CaseLoop mail reader |
| Supported account types | Single tenant — this organization only |
| Redirect URI | leave blank |
In your app registration, open Certificates & secrets → New client secret. Set a description and the longest expiry your policy allows (Microsoft’s maximum is 24 months).
Copy the Value column, not the Secret ID. The value is shown once and never again.
Now fill in all three fields on the wizard’s Credentials step.
| Directory (tenant) ID | from the app’s Overview page |
| Application (client) ID | from the app’s Overview page |
| Client secret value | the Value column, not the Secret ID |
This is the one thing about the Microsoft path that needs revisiting. When the secret expires, mail sync stops until a new one is pasted in. Create the replacement in Certificates & secrets, paste it into the wizard, then delete the old secret.
Open API permissions → Add a permission → Microsoft Graph → Application permissions and add both of these. Add them as Application permissions, not Delegated — CaseLoop reads mail as the application, with no signed-in user.
Then click Grant admin consent for your organisation. Both rows must read “Granted” before mail sync will work. The wizard builds a direct consent link for your tenant once it has the two IDs, so you can click through from there instead of hunting for the button.
Remove the default delegated User.Read permission if it is present. Nothing uses it.
Mail.Read | read mail in mailboxes |
User.Read.All | list the mailboxes in the tenant |
Back in CaseLoop, the Finish step already has everything it needs. Click Test connection.
A successful test reports how many mailboxes it found and names a few of them. It is optional, and it is worth the fifteen seconds — it catches a wrong value now instead of at six tomorrow morning.
If the test fails immediately after granting consent, wait a minute and run it again. Consent takes a moment to propagate.
By default the grant covers every mailbox in the tenant. To scope it to a subset, create a mail-enabled security group containing only the mailboxes CaseLoop should see, then apply an Application Access Policy to the app registration via Exchange Online PowerShell.
CaseLoop needs no configuration for this — once the policy is in place it simply sees fewer mailboxes.
| Cmdlet | New-ApplicationAccessPolicy |
-AppId | your Application (client) ID |
-PolicyScopeGroupId | the mail-enabled security group |
-AccessRight | RestrictAccess |
Afterwards
Nothing. That is the point of this path — mail begins syncing to each machine on its own, and no member of staff is asked to connect anything.
Mail is read into CaseLoop on each staff member’s own computer and stays there. It is not uploaded to CaseLoop’s servers. See Where your data lives.
Troubleshooting
| What you see | What to do |
|---|---|
| Grant admin consent is greyed out. | Your account can register apps but cannot consent for the organisation. A Global Administrator, or someone with Privileged Role Administrator, has to click it. Everything else in this guide is already done — they only need that one button. |
| The test says it cannot connect, right after you granted consent. | Wait a minute and press Test connection again. Consent propagates asynchronously. |
| The test reports an authorisation failure that does not clear. | Open API permissions and check the Status column. Both Mail.Read and User.Read.All must read “Granted”. The commonest cause is adding them as Delegated rather than Application permissions — delegated rows will never satisfy an app-only sign-in. |
The provider error mentions AADSTS7000215 or AADSTS7000222. | The client secret is wrong or has expired. Create a new one in Certificates & secrets, paste the Value into the wizard’s Credentials step, and delete the old secret once mail is flowing again. |
| You pasted the Secret ID instead of the secret value. | Entra shows the value only at creation. Create a new secret, copy the Value column this time, and delete the unused one. |
| Mail stopped syncing months after a working setup. | Check the client secret’s expiry in Certificates & secrets. Expiry is the usual cause, and it is silent until it happens. |
| You need CaseLoop to see fewer mailboxes than the whole tenant. | Step 6. An Application Access Policy scoped to a mail-enabled security group restricts the same grant without changing anything in CaseLoop. |
| Someone wants to connect just their own mailbox instead. | That is a different, smaller path and it does not need you. Send them Connect your Outlook. |
Mail starts appearing on each machine within a few minutes. If the test wouldn’t go green, send us what it said under “Provider said” — that line is the fastest thing to read.