Microsoft Entra · about 10 minutes

Set up your Microsoft connection.

LensMail is a public PKCE client. You provide a public Client ID; you never put a client secret in the app.

1. Register an application

  1. Open the Microsoft Entra admin center and choose App registrations.
  2. Select New registration.
  3. Name it LensMail or another name your organization recognizes.
  4. Choose the supported account type appropriate for your mailbox. For a private organization deployment, single tenant is usually the narrowest choice.
  5. Select Register, then retain the Application (client) ID and Directory (tenant) ID.

Do not create or enter a client secret. LensMail uses OAuth Authorization Code with PKCE as a public browser client.

2. Add the callback as a SPA

  1. Open Authentication for the app registration.
  2. Select Add a platform, then Single-page application.
  3. Add this exact redirect URI: https://auth.lensmail.net/auth/callback.html
  4. Save the configuration.

The redirect must be under Single-page application. Adding it only under Web or Mobile/Desktop causes Microsoft error AADSTS9002326.

What this callback address does

https://auth.lensmail.net/auth/callback.html is LensMail's fixed HTTPS return point for Microsoft sign-in. Even Hub runs installed apps on changing local ports, so Microsoft needs this stable address registered once. After you approve sign-in, Microsoft sends this page a short-lived, single-use authorization code and a random state value. The page validates the handoff, exchanges the code directly with Microsoft using PKCE, and returns the sign-in result to the installed LensMail app on your device.

What it is not: It is not a mailbox server, a Microsoft login form, or an account-sharing service. It does not receive your Microsoft password, require or store a client secret, read your email, or grant mailbox access simply because someone visits the address.

Privacy: The callback processes the sign-in result briefly in your browser, but it does not send tokens or mailbox content to a LensMail database. Temporary sign-in context stays in the current browser tab and is cleared after the handoff. Tokens return to the local LensMail app, and mailbox requests then go directly from LensMail to Microsoft Graph. The hosting provider may retain ordinary web request metadata, such as an IP address, browser type, timestamp, and short-lived callback parameters; it does not receive your password, mailbox content, or PKCE verifier.

Security: Because any OAuth callback is security-sensitive, LensMail uses a dedicated HTTPS domain, no third-party scripts, PKCE, random state validation, a ten-minute request limit, and restricted returns to local LensMail addresses. LensMail maintains the callback domain and page under restricted administrative control. You can revoke LensMail's Microsoft consent at any time. See the LensMail Privacy Policy for the complete data-flow explanation.

Security risk and responsibility: No internet-connected app or OAuth callback can guarantee absolute security. You and your organization are responsible for deciding whether LensMail is appropriate, protecting accounts and devices, configuring Microsoft Entra safely, reviewing permissions, monitoring access, and revoking consent when needed. To the maximum extent permitted by applicable law, LensMail, Eddie Rivera, and Wevem MSP are not responsible or liable for unauthorized access, account compromise, disclosure or loss of data, or other harm resulting from malicious attacks, unintended security incidents, third-party breaches, compromised credentials or devices, configuration errors, or compromise of LensMail or its callback and hosting infrastructure. This limitation does not exclude rights or liability that cannot legally be excluded. See the LensMail Terms of Service.

3. Add delegated Graph permissions

Under API permissions, add Microsoft Graph delegated permissions:

  • User.Read
  • Mail.ReadWrite
  • Mail.Send

Microsoft also requests openid, profile, and offline_access during sign-in. An administrator may need to grant consent, depending on tenant policy.

4. Save and sign in from LensMail

  1. Install LensMail from Even Hub and open it.
  2. On the phone companion, open Setup menu, then Graph setup.
  3. Enter the Application (client) ID.
  4. Enter the Directory (tenant) ID, or use common only when appropriate for your registration.
  5. Select Save and Sign In once and complete Microsoft sign-in.
  6. Return to LensMail. The opening menu begins on Read Email.

Troubleshooting

Redirect URI mismatch

Copy the URI exactly, including https, the /auth/ path, and callback.html.

Application not found in directory

Check that the Client ID belongs to the intended tenant and that the selected account type permits that user.

Sign-in completes but LensMail still requests sign-in

Confirm the callback is registered as a SPA, exit LensMail, reopen it, and retry. If the problem continues, contact support without sending tokens or authorization codes.