Prerequisite

The user who will be used as email sender in Dispatcher Paragon must have a valid Microsoft 365 license assigned.

Enabling SMTP AUTH Protocol

Dispatcher Paragon sends emails using authorized SMTP protocol, which needs to be enabled for the organization in Microsoft Azure, and for the specific user in Microsoft 365 Center.

SMTP AUTH protocol is not available when Microsoft Security Defaults are active, even if used with the Modern Authentication with OAuth 2.0 (see Microsoft documentation on the topic)

Therefore, Security Defaults must be disabled for the tenant:

• Navigate to https://portal.azure.com/#home

• Select Azure Active Directory > Properties > Manage Security Defaults > click No in Enable Security Defaults. Click Save.

SMTP protocol must also be enabled for the user account which will be used as email sender:

• Navigate to https://admin.microsoft.com/

• Select Users > Active users > select your user > select Mail tab > click Manage email apps.
  

• Make sure that Authenticated SMTP is selected
  

  

App registration

Next, we need an App registration which will contain URLs of your Dispatcher Paragon installation. The following steps are excerpts from the Microsoft guide:

• Log in to https://portal.azure.com/#home

• Under Azure Active Directory, you can find your App registrations. Click New registration or select an existing one

• Fill in the form:

  • Choose a name - it will be visible to your user during registration

  • For Supported account types, select the first or second option:

    • Accounts in this organization only (Single tenant) is preferred if this App registration will only be used for Dispatcher Paragon Emails

    • Accounts in any organization directory (Multi tenant) is also supported

    • Personal accounts are not supported

  • In the Redirect URI section, select Web and fill in the following URL https://<management_interface_url>/oauth2/client/smtp/authorize-callback

    • <management_interface_url> must be the same as the URL you use to access your management interface

(If the URI changes, or if there are multiple URIs, they can be modified later under Authentication tab of the created Client registration)

• Click Register

• On the created Client registration, under Overview tab, take note of the Application (client) id (when prompted later, enter it to the Client ID field in Dispatcher Paragon)

• Under Certificates & secrets, create a New client Secret (choose name and validity according to your needs). Once created, take note of the Value (when prompted later, enter it to the Client Secret field in Dispatcher Paragon)

  • Note: The Secret Value is only visible immediately after creation. If lost, a new secret needs to be created.

Dispatcher Paragon Authorization

• Navigate to System > Email configuration.

• In Connection Provider, select Microsoft 365.

• In Authorization type, select OAuth 2.0.

• Fill in the Client ID and Client secret according to the steps above.

• Click Authorize. A popup window will guide you through the authorization.

  • If your Management Service is accessible under multiple URLs, make sure to perform the authorization with the one that is registered in Azure. A common source of errors is using HTTP protocol where HTTPS is registered.

  • After successful authorization, your username will be copied over to Authorization username. In rare cases, the Authorization username may not be determined correctly, in which case it needs to be entered manually.

• Fill in the rest of the form according to your needs and save it.

Dispatcher Paragon is now set up to authorize emails using OAuth 2.0 with Microsoft.

Scopes used for Microsoft

• https://outlook.office.com/SMTP.Send - To be able to send emails

• openid and profile - To prefill the username field

• offline_access - To allow the authorization last for extended time

Prerequisite

The user who will be used as email sender in Dispatcher Paragon must have Google Mail enabled.

Client registration

We need a Client registration that will contain URLs of your Ysoft SafeQ installation.

• Log in to https://console.cloud.google.com/cloud-resource-manager

• Create a new Project
  

  

• Name it according to your needs
  

  

• Click Create.

• When the project is created, add Gmail API.
  

  

• And enable it.
  

  

• Create Credentials.
  

  

• Credential type is User data.
  

• Click Next

• Fill in App information
  

• Click Save And Continue

• It's not necessary to add any scopes, just click Save and Continue

• Fill OAuth Client ID form:

  • Application type: Web Application

  • Name: according you your needs

  • Authorized redirect URIs: Be sure to add Ysoft SafeQ address in this format: https://<your url>/oauth2/client/smtp/authorize-callback
    
    

• Generated Client ID and Client Secret are available on the Credentials tab
  
  

Adding a test user

The Client we have just created is not public, therefore only a limited range of users may use it. In order to make the Client public, it must be verified by Google, which is out of scope of this guide.
For Ysoft SafeQ purposes, only a handful of users need to be specified.

Select OAuth consent screen and in the Test Users section, click Add users. Input email of the users which will be used as email sender in Dispatcher Paragon.

Ysoft SafeQ Authorization

Google is not included in the presets, so a Custom connection provider must be selected and parameters filled manually:

Click Authorize, a popup window will guide you through the authorization.

• If your Management Service is accessible under multiple URLs, make sure to perform the authorization with the one that is registered in Google. A common source of errors is using HTTP protocol where HTTPS is registered.

• After successful authorization, your username will be copied over to Authorization username. In rare cases, the Authorization username may not be determined correctly, in which case it needs to be entered manually.

Fill the rest of the form and save it.

SafeQ is now set up to authorize emails using OAuth 2.0 with Google.