We do this one together, on a screen share. You drive — every step needs your own company's administrator account signed in — and we tell you where to click.
About 40 minutesAdministrator account neededDone once
0 of 5 steps done
It writes drafts. It cannot send. That is not a setting we switched off — there is no send action anywhere in the product, so a draft going out by accident is not something that can happen. Drafts sit in your Drafts folder until you read them, edit them, and press send yourself.
One thing worth saying up front, so this doesn't read as our software being awkward. Microsoft removed password sign-in for Microsoft 365 mailboxes some years ago. Any software that wants to read an M365 mailbox now has to be registered as an application inside your own company's Microsoft account and granted permission there. That is Microsoft's rule, and it applies to every product in this category.
It is why Gmail takes ten minutes and this takes forty. The good news: it is done once.
Before we start: three things to sort out
1. It has to be a work or school account
Addresses ending @outlook.com, @hotmail.com or @live.com are personal accounts and are not supported — Microsoft does not open this route to them. It has to be a Microsoft 365 subscription bought by the company, usually you@yourcompany.com.
2. Find who has the administrator account
This work can only be done by an account with Global Administrator permission. Sign in with it at admin.microsoft.com:
✓You get an admin console → that's the account, we'll use it.
✕“You don't have permission” → it isn't an administrator.
If nobody in the company knows who the administrator is, it is almost always one of these:
→Whoever bought Microsoft 365 in the first place — the owner, the office manager, the finance person — has it and doesn't know that's what it's called. Start by asking who set up Office 365 originally.
→It was bought through a reseller or IT supplier who holds the account. In that case, forward this document to them — everything below is routine work for them and takes about ten minutes.
If the work is going to an IT department or a supplier rather than to you, send them the version written for administrators instead. It is the same job, stated as a permission request with the procedure, the addresses we connect to, and how to revoke it.
Please settle this a day or two ahead. It is the one part of the process that can stall for days, and what stalls it is finding the right person internally, not anything technical.
3. Book 40 minutes on a screen share
Have ready: the administrator sign-in including the phone that receives the code, a Windows PC (one step uses PowerShell, which comes with Windows), and the mailbox address to connect.
The five steps we'll do together
Each step says what you will see and what to write down. No need to read ahead — we'll walk it with you.
You land on the application's Overview page, showing two values we need: Application (client) ID and Directory (tenant) ID. Both look like xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx. Copy them into a notepad.
CheckYour notepad has two IDs, each five groups joined by hyphens.
02
Grant it permission, and consent~5 min
In the application's left menu, click API permissions
Click Add a permission
Switch to the APIs my organization uses tab
Search for Office 365 Exchange Online and select it
Choose Application permissions
Expand IMAP and tick IMAP.AccessAsApp
Click Add permissions
Back on the list, click Grant admin consent for <company> and confirm Yes
This is the most commonly missed step. Without the green tick nothing after it works — and the error looks like a wrong password, which sends people looking in the wrong place.
CheckThe IMAP.AccessAsApp row shows a green tick (“Granted for…”).
03
Create a secret~3 min
Left menu: Certificates & secrets
Under Client secrets, click New client secret
DescriptionBestTeam, Expires the longest option (24 months)
Click Add
The new row has two columns that are easy to confuse:
Value
This is the one we need — a long mixed string of letters, digits and symbols
Secret ID
Not this one. It looks like the IDs above, and using it by mistake produces an endless “wrong password” error
The Value is shown once. Refresh the page and it is gone forever. Copy it into the notepad now. Also note the Expires date from that row — there is a section about it further down.
CheckYour notepad has one long secret and one expiry date.
04
Give it access to the mailbox~15 min · PowerShell
The first three steps were clicking in a browser. This one runs a few commands in Windows PowerShell. You only paste.
First we need one more value. Back at entra.microsoft.com: left menu Applications → Enterprise applications → searchBestTeam → open it → note the Object ID.
⚠️ This is where people go wrong. The App registrations page from step 1 also shows an “Object ID”, and that one is wrong. It has to be the one under Enterprise applications. The two pages look almost identical — check the left menu.
Fill in what you noted · the commands below update themselves
Do not put the step 3 secret here. This page does not need it — the secret goes into BestTeam only. These values stay in your own browser and are not sent anywhere.
Open PowerShell: open the Start menu, type PowerShell, right-click the result and choose Run as administrator. Paste one command at a time, letting each finish first.
1Install the Exchange management tools (first time only, 2–3 min)
If command 3 says it already exists, that's fine — some tenants create it automatically. Skip it and run command 4. If command 1 is refused by the execution policy, run Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned first and try again.
CheckCommands 3 and 4 each print a line of output, with no red error text.
05
Restrict it to this one mailbox~5 min · strongly recommended
As things stand after step 4, the application could in principle reach every mailbox in the company. This step locks it to the one. In the same PowerShell window:
Command 6 should report AccessCheckResult : Granted for this mailbox. To see the restriction working, run it again against a different company mailbox — that one should come back Denied.
The lock is not instant — Microsoft can take up to an hour to propagate it. So if the connection test fails immediately afterwards, wait a while before changing anything else.
CheckCommand 6 returns Granted for the target mailbox.
Finally: enter it in BestTeam
While building your team you reach a “Connect your mailbox” step:
Mailbox type
Microsoft 365 / Outlook (Exchange Online). The server and port fields disappear once you pick it — M365's are fixed.
Email address
the mailbox to connect
Directory (tenant) ID
from step 1
Application (client) ID
from step 1
Client secret
the Value from step 3
Secret expiry date
the Expires date from step 3
The expiry date is optional, but please fill it in. With it, you get a warning a month before the secret expires. Without it, the mailbox simply stops working one day, and the error looks exactly like a wrong password.
Then Test connection, and when it reports “Connection works.”, click Connect mailbox.
If it won't connect
The good news: the error names the step that is incomplete, and the four causes have completely different fixes.
The error mentions
Meaning
Go back to
Application (client) ID / client secret
The secret is wrong — most often the Secret ID was used instead of the Value
Step 3, create a fresh secret
Directory (tenant) ID
The tenant ID is wrong
Step 1, re-copy from Overview
IMAP.AccessAsApp Add-MailboxPermission
The secret is fine, but the mailbox was never opened up
Step 2 (green tick) and step 4
That the mailbox cannot be found
Address typo, or it isn't in this tenant
Check the address
The third row is the most common outcome of a half-finished setup: a working credential with a refused mailbox. It looks like “it won't connect”, but the cause is a missing admin consent in step 2 or a skipped command in step 4. Two attempts, then stop and send us a screenshot of the exact error.
What it can and cannot do
It can
Read this one mailbox, including text inside attachments
Create reply drafts in the Drafts folder
It cannot
Send email — there is no send action in the product
Reach any other company mailbox — that is what step 5 enforces
Sign in to your Microsoft 365, change settings, or see files
Read text inside images; a photographed invoice or a scan is blank to it
The secret is stored encrypted on our servers, and the key that decrypts it is not kept in the database.
One thing to do in about two years
The secret from step 3 expires (24 months at most). On that day the mailbox stops being processed, and the error looks exactly like a wrong password.
The fix: before it expires, go back to step 3 and create a second secret (you can leave the old one in place), then put the new Value into BestTeam's “Connect your mailbox” and reconnect. Steps 1, 2, 4 and 5 do not need repeating.
If you filled in the expiry date, you get a reminder a month ahead and don't have to track this yourself.
Revoking access
→In BestTeam: click Disconnect on the “Connect your mailbox” card.
→In Microsoft:entra.microsoft.com → Applications → App registrations → BestTeam → Delete. The application is gone and every permission with it.
→To pause rather than remove: delete just the secret underCertificates & secrets. The registration stays, and a new secret restores service.
Revoking does not affect normal mail, and does not delete drafts that have already been written.
If something goes wrong, write to admin@bestteam.online and send a screenshot of the exact error. Don't try to work out what it means — the wording tells us a great deal.