1. Register an application
- Open the Microsoft Entra admin center and choose App registrations.
- Select New registration.
- Name it LensMail or another name your organization recognizes.
- Choose the supported account type appropriate for your mailbox. For a private organization deployment, single tenant is usually the narrowest choice.
- Select Register, then retain the Application (client) ID and Directory (tenant) ID.
Do not create or enter a client secret. LensMail uses OAuth Authorization Code with PKCE as a public browser client.
2. Add the callback as a SPA
- Open Authentication for the app registration.
- Select Add a platform, then Single-page application.
- Add this exact redirect URI:
https://auth.lensmail.net/auth/callback.html - Save the configuration.
The redirect must be under Single-page application. Adding it only under Web or Mobile/Desktop causes Microsoft error AADSTS9002326.
3. Add delegated Graph permissions
Under API permissions, add Microsoft Graph delegated permissions:
User.ReadMail.ReadWriteMail.Send
Microsoft also requests openid, profile, and offline_access during sign-in. An administrator may need to grant consent, depending on tenant policy.
4. Save and sign in from LensMail
- Install LensMail from Even Hub and open it.
- On the phone companion, open Setup menu, then Graph setup.
- Enter the Application (client) ID.
- Enter the Directory (tenant) ID, or use
commononly when appropriate for your registration. - Select Save and Sign In once and complete Microsoft sign-in.
- Return to LensMail. The opening menu begins on Read Email.
Troubleshooting
Redirect URI mismatch
Copy the URI exactly, including https, the /auth/ path, and callback.html.
Application not found in directory
Check that the Client ID belongs to the intended tenant and that the selected account type permits that user.
Sign-in completes but LensMail still requests sign-in
Confirm the callback is registered as a SPA, exit LensMail, reopen it, and retry. If the problem continues, contact support without sending tokens or authorization codes.