In this article, I’ll guide you through the entire process — registering an app in Microsoft Entra ID, setting up the required permissions, and configuring D365F&O to use Microsoft Graph.
Prerequisites: Before you start
You’ll need permission to create an app registration and grant admin consent in Microsoft Entra ID (Global Administrator, or Application Administrator plus a role that can grant tenant-wide consent); the System administrator role in Dynamics 365 Finance & Operations; and a valid, licensed mailbox in your tenant to send from. The setup has two halves: first, Entra ID; then, F&O.
Part 1 — Microsoft Entra ID Register the application
Create the app registration
1 – Sign in to the Microsoft Entra admin center.
2 – Expand Entra ID in the left navigation.
3 – Select App registrations.
4 – Click New registration.
5 – Give it a clear name — something like D365-Graph-Email so its purpose is obvious later.
6 – Under Supported account types, choose Single tenant only.
7 – Leave the Redirect URI blank and click Register.
Create a client secret
The app needs a credential to prove its identity. A client secret is the quickest option.
8 – Open Certificates & secrets from the Manage menu.
9 – On the Client secrets tab, click New client secret.
10 – Enter a description, e.g. D365 Graph Email.
11 – Choose an expiry. Microsoft’s default recommendation is 180 days; you can go up to 24 months. Shorter is more secure but means more frequent rotation — pick what your team can realistically maintain.
12 – Click Add.
13 – Click Client secrets
14 – The secret’s Value appears only once. Copy it immediately.
Important
This is the single most common place people get stuck. Once you leave this screen, the secret value is hidden forever. If you miss it, you’ll have to delete it and create a new one.
Add the Microsoft Graph permission
15 – Go to API permissions.
16 – Click Add a permission.
17 – Select Microsoft APIs.
18 – Select Microsoft Graph.
19 – Because F&O sends mail as a background service with no signed-in user, choose Application permissions — not Delegated.
20 – Search for Mail.Send.
21 – Expand Mail.
22 – Tick Mail.Send — Send mail as any user.
23 – Click Add permissions.
Grant admin consent
Application permissions don’t take effect until an administrator approves them.
24 – Click Grant admin consent for [your tenant] and confirm. The status for Mail.Send should switch to a green “Granted” tick.
Copy the Application (client) ID
25 – Open the Overview page.
26 – Copy the Application (client) ID — you’ll paste this into F&O in a moment.
At this point, you should have two values saved: the Application (client) ID and the client secret value.
Part 2 — Finance & Operations Configure email
Open Email parameters
1 – In D365F&O, go to System administration.
2 – Expand Setup.
3 – Expand Email.
4 – Click Email parameters.
Enable Graph as the provider
5 – 6 – On the Configuration tab, set the Batch email provider to Graph.
7 – Under Enabled interactive email providers, move Graph from the Available list across to the Enabled list.
8 – Click Save.
9 – Open the Microsoft Graph settings tab.
Enter your credentials and test
10 – Paste the Application (client) ID into Application ID.
11 – Paste the client secret value into the Application secret.
12 – Click Test authentication.
If everything lines up, you’ll see Test succeeded at the top of the form. D365F&O will now send mail through Graph.