Skip to main content

​
Overview

A mailbox connection tells Ekso how to access an external email account. Once connected, you can set up ticketing to turn inbound emails into work items, reply from within Ekso, and maintain threaded conversations. You manage mailbox connections under Settings > Mailbox. Ekso supports two connection types: IMAP and Microsoft 365.

​
IMAP

Connect to any IMAP-compatible mail server — Google Workspace, Fastmail, or any standard email provider.
PropertyDescriptionDefault
NameDisplay name for this mailbox connection—
Connection typeSelect Imap—
ServerIMAP server address (e.g., imap.gmail.com)—
PortIMAP port993
UsernameMailbox account username—
PasswordMailbox account password—
SMTP serverServer for sending replies (e.g., smtp.gmail.com)—
SMTP server portSMTP port587
Inbox folderWhich folder to watch for new emailsInbox
IMAP connections track the last processed email by its UID (a unique message identifier assigned by the mail server). Each processing cycle queries for unseen messages or messages with a UID greater than the last processed one. This means IMAP picks up exactly where it left off, message by message.

​
Microsoft 365

Connect to Microsoft 365 mailboxes using OAuth authentication through Microsoft Graph.
PropertyDescription
NameDisplay name for this mailbox connection
Connection typeSelect Microsoft
Email addressEmail address of the mailbox to be used
OAuth tenant IDYour Azure AD tenant ID (found in admin.microsoft.com)
OAuth client IDThe application client ID from your Azure app registration
OAuth client secret valueThe secret value (not the secret ID) from your app registration
Inbox folderWhich folder to watch for new emails (default: Inbox)

​
Azure app registration

Before you can connect a Microsoft 365 mailbox, you need an app registration in Microsoft Entra with the correct Microsoft Graph permissions.
1

Open app registrations

Go to entra.microsoft.com → App registrations → select your app (or create a new one).
2

Add API permissions

Click API permissions → + Add a permission.
3

Select Microsoft Graph

Select Microsoft Graph → Application permissions.
4

Add required permissions

Search for and add the following permissions:
PermissionTypeDescriptionAdmin consent
Mail.ReadApplicationRead mail in all mailboxesYes
Mail.ReadBasicApplicationRead basic mail in all mailboxesYes
Mail.ReadBasic.AllApplicationRead basic mail in all mailboxesYes
Mail.ReadWriteApplicationRead and write mail in all mailboxesYes
Mail.SendApplicationSend mail as any userYes
MailboxFolder.ReadWrite.AllApplicationRead and write all users’ mailbox foldersYes
5

Grant admin consent

Click Grant admin consent for [your organization] and confirm. All six permissions require admin consent.
These are Application permissions, not Delegated. This means Ekso accesses the mailbox directly without a signed-in user — which is why admin consent is required for all six permissions. If you already have an app registration for Entra SSO, you can add these permissions to the same registration.
When creating a client secret under Certificates & secrets, copy the secret value — not the secret ID. The value is only shown once at creation time. This is the value you enter in the OAuth client secret value field.
Microsoft connections track the last processed date rather than UIDs. Each processing cycle queries Microsoft Graph for messages received after the last processed timestamp. The Start from date in the ticketing configuration sets the initial boundary — Ekso only processes emails received on or after this date, so historical emails in the mailbox are not accidentally converted into tickets.
IMAP and Microsoft 365 use different tracking mechanisms. IMAP resumes by message UID (precise per-message tracking). Microsoft 365 resumes by received date (time-window based). Both approaches prevent duplicate processing, but the Microsoft approach means the Start from date on the ticketing configuration is especially important for controlling what gets processed on first activation.
Use Microsoft 365 if your organization is already on Microsoft 365. The OAuth approach avoids storing email passwords and supports modern authentication policies like conditional access.

​
Credentials

All mailbox credentials are encrypted at rest before storage.

​
Testing connections

Use the connection test to verify that Ekso can connect to the mail server with the provided credentials. Test before setting up ticketing to catch configuration issues early. For end-to-end ticketing pipeline testing, see testing in the ticketing guide.