Microsoft 365 mailboxes (incl. shared mailboxes)

A Microsoft 365 mailbox connects by signing in with Microsoft. OmniBrand then reads new mail every minute and sends your replies from that mailbox. Nothing changes in your mail setup: no forwarding and no IMAP.

Before you start

• The Microsoft account you sign in with can open the mailbox: it is your own, or it is a shared mailbox you have been given Full Access to.
• To reply from a shared mailbox, your account also needs Send As (or Send on Behalf) on it. Your Microsoft 365 admin grants both under the shared mailbox's delegation settings.
• Your organisation lets you consent to the OmniBrand app, or an admin consents once for everyone (see below).

Step by step

Signed in to Microsoft on your phone rather than on the computer? The connect window also shows a QR code: see Connect an account from your phone.

1. Set up → Accounts → Email (or + Connect another on the Email card, or Add my mailbox).
2. Type the mailbox address - your own, or the shared one such as support@yourcompany.com - and click Continue.
3. Provider: Microsoft 365 / Outlook is shown. Keep Sign in with Microsoft (recommended) selected and click Sign in with Microsoft.
4. Microsoft's window opens. Sign in with your own account (for a shared mailbox too) and accept the permissions.
5. The account appears under Email as "Your Name (mailbox address)". For a shared mailbox, OmniBrand checks first that your account can open it.
6. Optional: click Settings on the row to set a Signature (optional) and click Save.

To connect several shared mailboxes, repeat these steps once per address. Each becomes its own account, even when they all use your one Microsoft login.

Fields and options (Settings on the row)

• Mailbox to watch - the mailbox this account reads and replies from. Your own mailbox by default; enter a shared mailbox you have access to instead and click Save. OmniBrand checks the address with Microsoft before saving.
• Signature (optional) - added under every reply. Who can change these two: owners and admins, and the person this mailbox belongs to (when it was given to one agent). Everyone else sees the mailbox and signature read only, with "Only an owner or admin, or the person this mailbox belongs to, can change the mailbox or signature."
• A mailbox that belongs to one agent reads mail with that agent's own Microsoft sign-in, so only that agent can change Mailbox to watch. An owner or admin sees the address read only, with the note "Only the person this mailbox belongs to can point it at a different mailbox. You can change the signature.", and can still change its Signature (optional) and click Save. A team mailbox (no agent) can be changed by any owner or admin.
• Who receives this mailbox (owners and admins) - the whole team, or one agent. See Give an agent their own mailbox.

What OmniBrand asks Microsoft for

Sign you in and read your basic profile; read your mail and send mail as you; read and send from mailboxes shared with you; and keep access (so it can work without you being signed in). These are delegated permissions: OmniBrand only reaches mailboxes your own account can open.

What the Microsoft admin must allow

• Consent. If the sign-in says Need admin approval, an admin (Global Administrator, or an admin allowed to grant consent) signs in once through the same button and ticks Consent on behalf of your organization, or grants admin consent to the app in the Microsoft Entra admin center. Nobody else is asked again.
• User assignment. If your organisation requires users to be assigned to apps, the admin assigns each person who connects to the OmniBrand app (Entra admin center → Enterprise applications → the app → Users and groups).
• Conditional access. A policy that blocks sign-ins from outside the company network or unmanaged devices will block this too; the admin must allow it.
• Mailbox rights for shared mailboxes: Full Access and Send As, as above.

No change to forwarding rules, IMAP or SMTP settings is needed.

Automatic renewal

Microsoft's access lasts about an hour at a time. OmniBrand renews it by itself shortly before it lapses and again if Microsoft refuses a request, so a mailbox keeps working without anyone signing in again. A temporary problem on Microsoft's side (busy service, network) does not disconnect the account; OmniBrand simply tries again. Only when Microsoft has really ended the sign-in does the account need you.

When it needs a reconnect: the reasons

The row then shows Sign-in expired, and Messages: Not arriving with our explanation, for example The platform no longer accepts this sign-in. Click Reconnect to sign in again. Click Details under it to see Microsoft's own reason, for example "Microsoft sign-in failed (400, AADSTS50173): the password was changed or reset…". The bell also tells you. What each reason means and what to do:

• AADSTS50173 - the password was changed or reset - Reconnect and sign in with the new password.
• AADSTS50055 - the password has expired - change the password with Microsoft, then Reconnect.
• AADSTS50057 - the account is disabled - the admin re-enables it; or connect with another account that can open the mailbox.
• AADSTS50053 - the account is locked after too many wrong passwords - wait or ask the admin to unlock it, then Reconnect.
• AADSTS50126 - the user name or password is wrong - Reconnect with the right details.
• AADSTS700082 - not used for 90 days and lapsed, or AADSTS70008 / AADSTS700084 - the sign-in has expired - Reconnect.
• AADSTS50076 / AADSTS50079 - Microsoft now requires multi-factor authentication - Reconnect and complete the MFA prompt.
• AADSTS50158 - a security check (conditional access) must be completed - Reconnect and complete the check.
• AADSTS53003 - a conditional access policy blocks it - the admin must allow OmniBrand in that policy; then Reconnect.
• AADSTS65001 - the permission for OmniBrand was removed - Reconnect and accept again (or the admin grants consent again).
• AADSTS50105 - the account is not assigned to the OmniBrand app - the admin assigns you to the app; then Reconnect.
• the OmniBrand app registration was refused - a problem on OmniBrand's side; do not reconnect, contact support.

While a mailbox is marked like this, OmniBrand still retries it every 30 minutes, so if the cause was lifted on Microsoft's side (for example the admin restored access) it can come back on its own.

How to reconnect

Click Reconnect on the mailbox's row and sign in again in Microsoft's window. For your own mailbox, sign in with that account. For a shared mailbox, sign in with your own account that has access to it: Reconnect carries the shared address, so that same account comes back with its history (your own mailbox is not added instead). If your account can no longer open the shared mailbox, the sign-in is refused with "... cannot open ...": ask your Microsoft 365 admin to restore Full Access, then click Reconnect again.

Good to know

• Replies are sent by the mailbox, threaded under the customer's email, and appear in its Sent Items. Attachments on replies: up to 3 MB each. Incoming attachments: up to 10 MB each.
• Drafts, mail the mailbox sent itself, and automatic mail (mailer-daemon, bulk and auto-submitted messages) do not become conversations.
• New mail is read in the order it arrived, up to 10 messages a minute, so after a busy hour (or when the mailbox is first connected) the rest follow over the next minutes. Bounces and the mailbox's own mail never hold up the messages behind them.
• If you use forwarding instead and Microsoft bounces it with 5.7.520, see Forwarding bounced.