Microsoft Entra · about 10 minutes

Set up your Microsoft connection.

LensMail is a public PKCE client. You provide a public Client ID; you never put a client secret in the app.

1. Register an application

  1. Open the Microsoft Entra admin center and choose App registrations.
  2. Select New registration.
  3. Name it LensMail or another name your organization recognizes.
  4. Choose the supported account type appropriate for your mailbox. For a private organization deployment, single tenant is usually the narrowest choice.
  5. Select Register, then retain the Application (client) ID and Directory (tenant) ID.

Do not create or enter a client secret. LensMail uses OAuth Authorization Code with PKCE as a public browser client.

2. Add the callback as a SPA

  1. Open Authentication for the app registration.
  2. Select Add a platform, then Single-page application.
  3. Add this exact redirect URI: https://auth.lensmail.net/auth/callback.html
  4. Save the configuration.

The redirect must be under Single-page application. Adding it only under Web or Mobile/Desktop causes Microsoft error AADSTS9002326.

3. Add delegated Graph permissions

Under API permissions, add Microsoft Graph delegated permissions:

  • User.Read
  • Mail.ReadWrite
  • Mail.Send

Microsoft also requests openid, profile, and offline_access during sign-in. An administrator may need to grant consent, depending on tenant policy.

4. Save and sign in from LensMail

  1. Install LensMail from Even Hub and open it.
  2. On the phone companion, open Setup menu, then Graph setup.
  3. Enter the Application (client) ID.
  4. Enter the Directory (tenant) ID, or use common only when appropriate for your registration.
  5. Select Save and Sign In once and complete Microsoft sign-in.
  6. Return to LensMail. The opening menu begins on Read Email.

Troubleshooting

Redirect URI mismatch

Copy the URI exactly, including https, the /auth/ path, and callback.html.

Application not found in directory

Check that the Client ID belongs to the intended tenant and that the selected account type permits that user.

Sign-in completes but LensMail still requests sign-in

Confirm the callback is registered as a SPA, exit LensMail, reopen it, and retry. If the problem continues, contact support without sending tokens or authorization codes.