Connect M365 for Me.

1. Use Connect M365 for Me

1. Install LensMail from Even Hub and open it. Version 3.0.0 is the current public release.
2. In the phone companion's Microsoft Connection panel, select Connect M365 for Me.
3. Sign in on Microsoft's page with the work or school account whose mailbox you want to use.
4. Review and approve the delegated permissions requested for that signed-in account.
5. Return to LensMail. Your Microsoft connection and sign-in remain saved in the installed app.

2. If administrator approval is required

LensMail is not currently a Microsoft verified publisher. Some organizations allow users to approve delegated apps, while others require a Microsoft 365 administrator to approve LensMail first.

1. Open Connection Options in the LensMail phone companion.
2. Select Administrator Approval.
3. Ask an authorized Microsoft 365 administrator to complete Microsoft's approval prompt for your organization.
4. Return to LensMail and select Connect M365 for Me again.

Administrator approval permits users in that organization to complete LensMail sign-in under the organization's own Microsoft policies. It does not give LensMail application-wide mailbox access.

3. Optional organization-specific application

Organizations that prefer to own their Microsoft application registration can select Use Organization-Specific App. This advanced option requires a Microsoft Entra public-client registration.

Register the application

1. Open the Microsoft Entra admin center and choose App registrations.
2. Select New registration.
3. Name it LensMail or another name your organization recognizes.
4. Choose the supported account type appropriate for the mailbox. Single tenant is usually the narrowest choice for one organization.
5. Select Register.
6. From Overview, copy the Application (client) ID and Directory (tenant) ID.

Add the callback as a SPA

1. Open Authentication for the app registration.
2. Select Add a platform, then Single-page application.
3. Add exactly https://auth.lensmail.net/auth/callback.html.
4. Save the configuration.

The redirect must be registered under Single-page application. Adding it only under Web or Mobile/Desktop causes Microsoft error AADSTS9002326.

Add delegated Microsoft Graph permissions

Add User.Read, Mail.ReadWrite, and Mail.Send as delegated permissions. Microsoft also requests openid, profile, and offline_access during sign-in.

Enter the organization details

1. In LensMail, open Connection Options and select Use Organization-Specific App.
2. Enter the Application (client) ID and Directory (tenant) ID.
3. Select Save and Sign In once, then complete Microsoft sign-in.

Optional Outlook contacts in 3.0.1

LensMail 3.0.1 is being prepared for submission. These optional steps apply only once you have that version installed; email setup in 3.0.0 stays the same.

1. Open My LensMail on the phone, choose My contacts, then Outlook.
2. Choose read-only contact access to browse your personal Outlook contacts. Microsoft asks for delegated Contacts.Read.
3. Sign in with the same Microsoft account used for LensMail email. Your organization may require administrator approval.
4. Only if you want to create or edit Outlook contacts, choose Allow contact editing. Microsoft then asks for delegated Contacts.ReadWrite.
5. Choose a contact to address a message. Keep locally saves a device-only copy. Only an explicit Save to Outlook creates or updates an Outlook contact.

For an organization-owned registration, ask your administrator to add only the delegated contact permission you intend to use. Read-only browsing needs Contacts.Read; editing needs Contacts.ReadWrite. There is no Contacts.Write permission. The Client ID, tenant, callback URI, and existing mail permissions do not need to change. Existing consent may need an additional approval under your organization's policies.

Disconnect Outlook contacts removes LensMail's optional contact connection from the device, not Microsoft's consent record. To revoke the permission itself, use Microsoft's app-permission controls or ask your administrator. Review contact privacy and storage before connecting.

What the callback address does

https://auth.lensmail.net/auth/callback.html is LensMail's fixed HTTPS return point for Microsoft sign-in. Even Hub runs installed apps on changing local ports, so Microsoft needs this stable address. After approval, Microsoft sends the page a short-lived, single-use authorization code and random state value. The page validates the handoff, exchanges the code directly with Microsoft using PKCE, and returns the sign-in result to the installed LensMail app.

What it is not: It is not a mailbox server, Microsoft login form, or account-sharing service. It does not receive your Microsoft password, require or store a client secret, read your email, or grant mailbox access merely because someone visits it.

Privacy: Temporary sign-in context stays in the current browser tab and is cleared after the handoff. Tokens return to the local LensMail app, and mailbox requests go directly from LensMail to Microsoft Graph. The hosting provider may retain ordinary web request metadata, but it does not receive your password, mailbox content, or PKCE verifier.

Security: LensMail uses a dedicated HTTPS domain, no third-party scripts on the callback, PKCE, random state validation, a ten-minute request limit, and restricted returns to local LensMail addresses. LensMail maintains the callback domain and page under restricted administrative control. You can revoke consent at any time. Review the Privacy Policy and Terms of Service.

Security risk and responsibility: No internet-connected app or OAuth callback can guarantee absolute security. You and your organization are responsible for deciding whether LensMail is appropriate, protecting accounts and devices, reviewing permissions, and revoking consent when needed. To the maximum extent permitted by applicable law, LensMail, Eddie Rivera, and Wevem MSP are not responsible for unauthorized access, account compromise, data loss, or other harm caused by attacks, third-party incidents, compromised credentials or devices, configuration errors, or compromise of LensMail or its hosting infrastructure. This does not exclude rights or liability that cannot legally be excluded.

After connecting in LensMail 3

Your account opens the same Microsoft mailbox you use in Outlook. Read Email offers Inbox, Drafts, Sent Items, Archive, Deleted Items, and your own folders. Focused/Other can be combined with Unread, Flagged, or With Attachments. Review the 3.0 manual for the new direct-reading and keyboard controls.

Existing users do not need a new Client ID, Tenant ID, callback, or client secret for 3.0. The delegated permissions remain User.Read, Mail.ReadWrite, and Mail.Send. Save to Drafts never sends; the new Review & Send flow requires a separate explicit confirmation.

Connect M365 for Me uses LensMail's existing public Microsoft app. It does not ask you to build your own registration. An Enterprise Application/service principal may appear in your organization when Microsoft consent is granted; your administrator controls that consent. Use the organization-specific option only when your organization's policy calls for it.

Troubleshooting

Microsoft says administrator approval is needed

Use Connection Options, open Administrator Approval, and ask an authorized Microsoft 365 administrator to complete the Microsoft prompt.

Application not found in directory

If using an organization-specific app, verify that its Client ID belongs to the intended tenant and that its supported account type permits the selected account.

Redirect URI mismatch

For an organization-specific app, copy the URI exactly, including https, the /auth/ path, and callback.html.

Sign-in completes but LensMail still requests sign-in

Exit LensMail, reopen it, and retry once. If the problem continues, contact support@lensmail.net without sending passwords, tokens, authorization codes, or confidential email content.

Contacts are declined, blocked, or need reconnecting

Your email connection stays in place. Use local contacts while your administrator reviews contact access, or reconnect contacts using the same Microsoft account. Contact sign-in and contact errors are handled separately from email.

A contact save times out

Check Outlook People before saving again. Microsoft may have completed the first request. LensMail does not automatically retry contact writes.

More questions? Visit the LensMail FAQ or Support. Never share sign-in tokens or confidential mail in a support request.