Setting Up Microsoft Graph Email for WebReports

This guide explains how to prepare a Microsoft Entra application and configure Microsoft Graph email delivery in WebReports 2026.10.12 and later. WebReports uses the email profile for scheduled reports, notifications, invitations, and account-recovery messages.

For SMTP configuration and the general email-profile workflow, see Creating an Email Profile in WebReports.

Before you begin

Have the following available:

• WebReports 2026.10.12 or later and a WebReports administrator account.
• A Microsoft 365 tenant with a sender mailbox in Exchange Online.
• Permission to register an application in that tenant, or assistance from your Microsoft Entra administrator.
• An administrator authorized to grant Microsoft Graph application permissions, such as a Privileged Role Administrator. WebReports administrator access does not grant Microsoft Entra consent permissions. See Microsoft's administrator consent requirements.
• Confirmation that your organization permits client-secret authentication for this integration.

WebReports uses the application's identity to send mail without an interactive mailbox sign-in. This requires application permissions, rather than only delegated permissions. See Microsoft's app-only access documentation.

1. Register the Microsoft Entra application

1. Sign in to the Microsoft Entra admin center.
2. Switch to the tenant containing the sender mailbox if you manage more than one tenant.
3. Open Entra ID → App registrations and choose New registration.
4. Give the application a descriptive name, such as WebReports Email.
5. Under Supported account types, choose the single-tenant option for your organization.
6. Select Register.
7. On the application's Overview page, record the Application (client) ID and Directory (tenant) ID.

These become the Client ID and Tenant ID in WebReports. For current portal instructions, see Microsoft's application-registration guide.

2. Add Mail.Send and grant administrator consent

1. In the app registration, open API permissions.
2. Choose Add a permission → Microsoft Graph → Application permissions.
3. Find and select Mail.Send, then select Add permissions.
4. Have the authorized administrator review the requested permissions, select Grant admin consent for your tenant, and confirm.
5. Refresh the permissions page and verify that Mail.Send has type Application and shows consent granted for your tenant.

Microsoft identifies Mail.Send as the application permission for sending mail through Microsoft Graph. The API-permission guide explains the portal controls.

Mailbox access: The Entra Mail.Send application grant can allow sending as any mailbox in the tenant. The WebReports Sender Mailbox field selects the mailbox WebReports uses; it does not itself restrict the application's Microsoft permissions. See the Microsoft Graph permission description.

If your organization requires access limited to particular mailboxes, have the Exchange administrator review Microsoft's RBAC for Applications guidance. Entra grants and Exchange RBAC grants are additive: adding a scoped RBAC grant does not narrow an existing unscoped Entra grant. Coordinate the authorization design with your administrators and confirm the WebReports configuration with BridgeWorks Support when using an alternative to the consented-permission setup described here.

3. Create a client secret

1. In the app registration, open Certificates & secrets → Client secrets.
2. Select New client secret.
3. Enter a description, choose an expiration according to your organization's policy, and select Add.
4. Copy the secret's Value immediately to an approved secure location. Microsoft does not display it again after you leave the page.
5. Record the expiration date so the credential can be replaced before it expires.

WebReports requires the secret value, not the Secret ID. If the value was not saved, create a replacement secret.

Microsoft recommends certificate or federated credentials for production applications. These instructions use the Client Secret configuration shown in WebReports. If your policy requires another credential type, confirm a supported setup with BridgeWorks Support. See Microsoft's credential-management guidance.

4. Configure WebReports

1. Sign in to WebReports with an administrator account.
2. Open Configuration → Email.
3. Set Email Delivery Method to Microsoft Graph.
4. Enter the following values.

Microsoft Graph delivery settings in WebReports. The mailbox shown is an example; use your organization's mailbox and application details.

Select Update to save the profile. WebReports encrypts the Graph settings when saved.

5. Send and verify a test email

1. After saving, select Send Test Email.
2. Select Yes in the confirmation dialog.
3. Check the email address associated with your signed-in WebReports account for the message.
4. If it does not arrive, check the junk or spam folder and review any error displayed by WebReports.

Confirm actual delivery before relying on scheduled-job notifications or other application emails. Microsoft notes that acceptance of a sendMail request does not by itself confirm delivery.

If the test fails

• Authentication: Check the Tenant ID, Client ID, secret value, and secret expiration against the app registration.
• Permission or access denied: Verify the Mail.Send application permission and administrator consent. If mailbox-access restrictions are configured, have the Exchange administrator check the sender mailbox's allowed scope.
• Mailbox: Confirm that Sender Mailbox identifies an existing mailbox in the same tenant.
• Connection: Have the server administrator verify connectivity to Microsoft Entra authentication and Microsoft Graph services. Review WebReports Deployment Requirements and Network Architecture.

After correcting the settings, select Update and send another test. If the issue continues, contact BridgeWorks Support with the WebReports version and exact error. Exclude client secrets, access tokens, and other credentials.

Replace a client secret before it expires

1. Create a new secret for the same app registration and securely record its value and expiration.
2. Enter the new value in the WebReports Client Secret field and select Update.
3. Send a test email and confirm delivery.
4. After successful verification, have the administrator retire the old secret after confirming that no other application instance depends on it.

Related articles

• Creating an Email Profile in WebReports
• Custom Email Templates
• WebReports Release Notes Version 2026.10.12