Mailbox setup (Microsoft 365)

Reading a mailbox needs a one-time Microsoft 365 / Entra ID app registration with Mail.Read permission, approved by an administrator. Without it, the mailbox can be saved but will not read mail.

1. Register an Entra ID application

1. Open Azure Portal → Microsoft Entra ID → App registrations → New registration.
2. Name it (e.g. “Enterprise Memory Mailbox”), choose Single tenant.
3. From Overview, note the Directory (tenant) ID (for EM Config) and Application (client) ID (set as GRAPH_CLIENT_ID in deployment env — not in the GUI).

2. Grant Mail.Read and admin consent

1. API permissions → Add a permission → Microsoft Graph → Application permissions.
2. Add Mail.Read.
3. Click Grant admin consent for your tenant (administrator required).

3. Create a client secret

1. Certificates & secrets → New client secret.
2. Copy the secret value immediately (shown once).
3. In Monitoring, store it as a connector credential, then select it when adding a mailbox.

4. Add the mailbox in Monitoring

Enterprise Memory → register a Mailbox source (sources are no longer registered inside AML): email address, lookback window, and the Graph tenant ID / client secret from Enterprise Memory → Config (application client ID comes from deployment env, not the GUI).

• Setup needed — saved, but not yet reading (missing consent or credential).
• Reading mailbox… — first pull in progress (large windows can take a while).
• Healthy — reading successfully. The UI never labels this “Connected.”

Lawful purpose and retention

Only configure mailboxes your organisation has a lawful basis to process. Lookback controls how far back the first pull reaches; retention (when configured) controls how long ingested mail is kept — they are separate settings.