Email Configuration

Email delivery for Specops Authentication can be configured in different ways:

• Using the Specops Default Configuration, which is set up in Specops Authentication Web.
• Using SMTP with anonymous access or basic authentication.
• Using Microsoft Graph API.

To use your own email delivery method instead of the Specops Default Configuration, follow the instructions below.

Note

Configuring SMTP or Microsoft Graph API in the Gatekeeper Admin Tool sends all emails from Specops Authentication through your Gatekeeper and replaces the sender name and address configured in Specops Authentication Web. The Email Settings page in Specops Authentication Web becomes read-only and displays a banner directing you to the Gatekeeper Admin Tool.

If you switch back to the Specops Default Configuration, the sender name and address are reset to the Specops defaults. Previous sender settings are not restored. To use a custom sender name and address again, configure them in Specops Authentication Web.

When SMTP or Microsoft Graph API is configured and no Gatekeeper is connected:

• Emails to Cloud Accounts are sent through the Specops mail server, with a line at the top stating that the Gatekeeper is offline.
• All other emails, including emails to users in Active Directory or Microsoft Entra ID, fail to send.

Configuring SMTP settings

To use SMTP as the email delivery method:

1. Click Email Configuration.
2. Click Edit.
3. Select which type of configuration you would like to use from the drop-down (anonymous access or basic authentication).
4. Enter the domain for the SMTP server (required).

5. Set the maximum number of concurrent connections the Gatekeeper will use when sending emails.

   Note

   Any time changes are made in this field, all affected Gatekeepers need to be restarted.

   Note

   The default for the maximum number of concurrent connections is set to 10. Please consult your SMTP server documentation on how many concurrent connections are allowed.

6. Enter the SMTP Port (default is set to port 25).

7. Select whether TLS (Transport Layer Security) shall be used or not. Set this option to Yes if you want to enable encryption for outgoing mail.

   Note

   Enabling TLS will automatically set the SMTP port to 587.

   Note

   A valid SSL certificate is required to use TLS when sending SMTP mails.

8. Enter the Sender Email Address (required) and Sender Display Name.

9. For Basic Authentication only: enter the SMTP username and password.
10. Click OK.
11. Click OK in the confirmation dialog and restart all Gatekeepers if the Max concurrent connection option was changed.

Configuring Microsoft Graph API settings

You can use Microsoft Graph API for email delivery instead of traditional SMTP.

Note

Before configuring the Microsoft Graph API, an app registration must be created in Microsoft Entra ID with Microsoft Graph Mail.Send application permission and admin consent granted. Refer to Configuring an app in Microsoft Entra.

1. Click Email Configuration.
2. Click Edit.
3. Select Microsoft Graph API from the drop-down.
4. In the Sender Email Address field, enter the email address that emails will be sent from.
   • This must be a valid mailbox in Microsoft 365 (user or shared).
   • The app registration must have permission to send as this mailbox.
5. Use the values from your Microsoft Entra app registration to complete the following fields. Refer to Configuring an app in Microsoft Entra.
   1. In the Tenant Id field, enter your Microsoft Entra ID tenant ID.
   2. In the Client Id field, enter the Application (Client) ID of your app registration.
   3. In the Client Secret field, enter the Client Secret value created for your app registration. Use the secret value, not the secret ID.
6. Click OK.
7. Click OK in the confirmation dialog.