Skip to main content

Email

Tagaris sends a small amount of email: the daily renewals digest, user invites and password resets. You choose how it sends under Settings then Email. There are three transports:

  • SMTP: a classic mail server with a username and password. Microsoft and Google are switching off basic-auth SMTP, so this is best for your own mail server or a transactional provider.
  • Microsoft 365 (OAuth): an app registration using OAuth; the app calls Microsoft Graph under the hood. This is the approach Microsoft recommends now that basic-auth SMTP is going away.
  • Google Workspace: the Gmail API with a service account.

Set the fields for a transport, save them, then select it with "Use this transport" and use "Send test email" on the same Email tab to check it. The test sends to your own address and reports the exact error if it fails.

Password resets and invites depend on email. The sign-in page's "Forgot password?" link delivers a reset link by email, valid for one hour, and any configured transport delivers it; without one there is no self-service reset. User invites are also sent by email; without a working transport, copy the invite link from the pending list and send it yourself.

Microsoft 365 (OAuth)​

Tagaris authenticates as an application (client-credentials OAuth) and calls Graph sendMail. There is no user sign-in at send time, which suits the daily digest.

You need an Entra app registration with the Mail.Send application permission and admin consent, and a sender mailbox. You can reuse the app you created for single sign-on, or use a separate one.

  1. App registration. In the Microsoft Entra admin centre, open the app (or create one under App registrations). Note the directory (tenant) ID and application (client) ID from its Overview.

  2. Permission. Go to API permissions, then Add a permission, then Microsoft Graph, then Application permissions, and add Mail.Send. Then choose Grant admin consent. Application permissions do not work without consent.

  3. Restrict the sender (recommended). By default Mail.Send lets the app send as any mailbox in the tenant. Limit it to one mailbox with an application access policy. In Exchange Online PowerShell:

    # A mail-enabled security group containing only the sender mailbox
    New-DistributionGroup -Name "Tagaris senders" -Type Security -Members alerts@example.com

    New-ApplicationAccessPolicy -AppId <client-id> `
      -PolicyScopeGroupId "Tagaris senders" `
      -AccessRight RestrictAccess `
      -Description "Restrict Tagaris to its sender mailbox"

    Now the app can only send as members of that group.

  4. Client secret. Under Certificates and secrets, create a client secret and copy its Value (not the ID). Record the expiry you choose somewhere you will see it: Tagaris warns before an SSO secret lapses if you set it in the SSO settings, but the mail secret is not tracked.

  5. Sender mailbox. Pick a real mailbox with an Exchange Online licence (a user or shared mailbox), for example alerts@example.com.

  6. In Tagaris. Settings then Email, choose Microsoft 365 (OAuth), and enter the tenant ID, client ID, client secret and sender address. Save, then set "Use this transport", then send a test email from the same tab.

If the test fails​

  • 403 (access denied): the Mail.Send permission is missing or not consented, or an application access policy is blocking the sender. Recheck steps 2 and 3.
  • 404 (sender not found): the sender address is not a mailbox in the tenant, or it has no Exchange Online mailbox. Recheck step 5.
  • Sign-in failed: the tenant ID, client ID or secret is wrong, or the secret has expired. Recheck steps 1 and 4.

Google Workspace​

Tagaris signs a JWT with a service account key and calls the Gmail API on behalf of a sender in your domain (domain-wide delegation).

  1. In Google Cloud, create a service account and a JSON key. Enable the Gmail API.
  2. In the Google Workspace admin console, under Security then API controls then Domain-wide delegation, authorise the service account's client ID for the scope https://www.googleapis.com/auth/gmail.send.
  3. In Tagaris, Settings then Email, choose Google Workspace, and enter the service account client email, the private key, and the sender address (a real user in your domain the service account may impersonate). Save, select the transport, and send a test.

SMTP​

Enter the host, port, username, password and From address under Settings then Email with SMTP selected. Use TLS on port 465, or STARTTLS on 587. The password is stored encrypted. This is the right choice for your own mail server or a transactional email provider that still allows username and password.