Register an Entra App for Outlook Email Integration

This guide walks your Microsoft 365 administrator through registering a Microsoft Entra application for use with the NexWave Outlook email integration. Once the app is registered, you send four values back to your NexWave team, and they complete the connection on the NexWave side.

The whole process is one-off and typically takes ten to fifteen minutes.

Before you start

You will need:

Microsoft 365 Admin or Application Administrator access to your organisation's Microsoft Entra tenant. The account performing these steps must be allowed to register applications and grant admin consent.
The Redirect URI that your NexWave team has provided to you. It looks like https://demo.nexwaveapp.com/api/method/frappe.integrations.doctype.connected_app.connected_app.callback/900fa1de84. The exact value is unique to your NexWave site, do not use the example shown here. Have it open in a separate tab or pasted into a notepad before you begin.
Authenticated SMTP enabled on the mailbox you intend to connect. Microsoft 365 disables this by default; your NexWave team will remind you of this prerequisite in the same message that contains the Redirect URI.

You do not need access to your NexWave site for any step in this guide. Everything happens inside the Microsoft Entra admin centre.

Step 1: Sign in to Microsoft Entra

Open https://entra.microsoft.com in a browser and sign in with the administrator account described above. Make sure the directory shown in the top-right corner is the organisation you want the application registered in.

Step 2: Open App registrations

In the left navigation, expand Identity → Applications and select App registrations.

Step 2

Step 3: Start a new registration

Click New registration at the top of the App registrations page.

Step 3

Step 4: Register the application

Fill in the registration form as follows:

Name: NexWave Outlook Integration (or any descriptive name your team will recognise).
Supported account types: Select Accounts in this organizational directory only (Single tenant). Do not pick a multi-tenant option, the integration only needs to work for users inside your own organisation.
Redirect URI: Choose Web as the platform, then paste the Redirect URI supplied by your NexWave team.

Click Register to create the application.

Step 4

The screenshot above is illustrative, the Supported account types option you select must be the single-tenant one even if the screenshot shows a different choice.

Step 5: Copy the Application (client) ID and Directory (tenant) ID

After registration completes, Microsoft Entra opens the application's Overview page.

Copy the following two values and save them somewhere safe, you will need to send both to your NexWave team:

Application (client) ID
Directory (tenant) ID

Step 5

Step 6: Open Certificates & secrets

In the application's left-hand navigation, select Certificates & secrets, then click New client secret.

Enter a description (for example, NexWave OAuth secret) and choose an expiry. We recommend the longest expiry your organisation's policy permits, because NexWave will need a new secret each time the current one expires.

Click Add to create the secret.

Step 7: Copy the secret Value immediately

Microsoft Entra now displays the new secret. Copy the value in the Value column, not the Secret ID, and save it somewhere safe.

Step 7

Important: The secret value is shown only once. If you navigate away from this page before copying it, the value is no longer retrievable and you will need to create a new secret. The Secret ID is a separate field, do not send that to NexWave by mistake.

Step 8: Open API permissions

In the left navigation, select API permissions, then click Add a permission.

Step 8

In the panel that opens, select Microsoft Graph.

Step 9: Choose Delegated permissions

On the Microsoft Graph permissions page, select Delegated permissions. Do not select Application permissions, NexWave authenticates as the mailbox user and requires delegated access.

Step 9

Step 10: Add the required permissions

Use the search box to find and tick each of the following permissions:

IMAP.AccessAsUser.All: required for NexWave to receive emails from the mailbox.
SMTP.Send: required for NexWave to send emails through the mailbox.
offline_access: required so NexWave can refresh access tokens without prompting the user repeatedly.

User.Read is added automatically and does not need to be selected manually.

Click Add permissions when all three are selected.

Step 10

Step 11: Grant admin consent

On the API permissions page, click Grant admin consent for <Your Organisation> at the top of the permissions list, then confirm in the dialog that appears.

The Status column should change to a green tick reading Granted for <Your Organisation> for every permission.

Step 11

If you do not see the Grant admin consent button, your signed-in account does not have Application Administrator or Global Administrator rights. Ask an administrator with those rights to perform this step.

Step 12: Open Endpoints

Return to the application's Overview page using the breadcrumb at the top of the screen, then click Endpoints in the toolbar.

Step 12

Step 13: Copy the OpenID Connect metadata document URL

In the Endpoints panel that opens on the right, locate the OpenID Connect metadata document field and copy its full URL. It looks similar to:

https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration

Step 13

This is the last value you need to collect.

What to send back to your NexWave team

Reply to your NexWave contact with the following four values. Send them through whatever channel they specified (typically the support ticket they raised this from, or a direct email).

Value	Where you copied it from
Directory (tenant) ID	Step 5, application Overview page
Application (client) ID	Step 5, application Overview page
Client secret value	Step 7, Certificates & secrets (shown once only)
OpenID Connect metadata document URL	Step 13, Endpoints panel

Treat the Client secret value like a password. Send it through a channel your organisation considers acceptable for credential sharing. If your security policy disallows sending secrets over email, ask your NexWave team for a more secure exchange method.

Once your NexWave team has all four values, they will complete the configuration on the NexWave side and confirm when the mailbox is ready for use.