- \n
- Access to the Microsoft Azure Portal.<\/li>\n\n\n\n
- Credentials for an account with Global Administrator or Application Administrator privileges in your organization’s Microsoft 365 environment.<\/li>\n\n\n\n
- The R2 Docuo certificate file (
.cer<\/code>) downloaded from https:\/\/downloads.r2docuo.com\/certificate.zip.<\/a><\/li>\n\n\n\n- An account of your organization with a mailbox on your Exchange Online<\/li>\n<\/ul>\n\n
Mailing Application Registration<\/strong><\/h2>\n\n
To register a new application in the Microsoft Azure Portal you will need to follow the steps below. You must complete all of them before configuring it in Docuo. <\/p>\n\n
Access to the application registration page<\/h3>\n\n
- \n
- Access the Microsoft Azure Portal at<\/strong> <\/a>https:\/\/portal.azure.com<\/a> and sign in with your organization’s Microsoft 365 account administrator credentials.
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/Graph-1.png\")
<\/li>\n\n\n\n- If the App registrations<\/em> option appears directly ,<\/em> click on it. Otherwise go to search for App registrations in the search bar,<\/em> once located*,* click on the icon*.*.
Create a new application record<\/h3>\n\n
- \n
- Click on New Registration<\/em> to create the application for R2 Docuo to access.
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/Graph-2.png\")
- Enter a name that makes it clear what the application will be used for, e.g. “Application for sending mails from R2 Docuo”.<\/li>\n\n\n\n
- Under Supported account types<\/em>, click Only accounts in this organizational directory (your company name).<\/em><\/li>\n\n\n\n
- Click on Register<\/em>. The new application page will open:
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/Graph-3.png\")
- Copy and save the value of the de Application ID (customer) <\/strong> y Directory ID (tenant) <\/strong><\/em>. Which you will need to enter in the mailing configuration in R2 Docuo later on.<\/li>\n<\/ol>\n\n
Certificate of access<\/h3>\n\n
- \n
- Download R2 Docuo certificate file (public key) from the following URL: https:\/\/downloads.r2docuo.com\/certificate.zip<\/a><\/li>\n\n\n\n
- Unzip the ZIP file and save r2docuo.cer<\/strong> to your hard disk.<\/li>\n\n\n\n
- In the application we have created in the Azure portal Click on Certificates and secrets, select the Certificates tab on the right and<\/em> click on Upload certificate.<\/em>
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/Graph-4.png\")
<\/li>\n\n\n\n- Select the certificate file r2docuo.cer from your hard disk.<\/li>\n<\/ol>\n\n
Grant permissions to the application<\/h3>\n\n
- \n
- Now we are going to define the permissions of your application, click on API Permissions<\/em> and then on Add a Permission<\/em>
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/graph-6.png\")
- Search and click on the Microsoft Graph<\/em> option
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/graph-7.png\")
- Now click on Application Permissions<\/em>
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/graph-8.png\")
- Enter Mail.Send in the search box. Once found, mark it in the list.
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/graph-9.png\")
<\/li>\n\n\n\n- Click on Add permissions<\/em>. By default, the new permission, Mail.Send, appears in your permissions list with the status Not Granted.<\/em>
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/graph-10.png\")
- You must grant consent with the Grant<\/em> button located on the list toolbar*.* If successful, the permission will appear like this:
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/graph-11.png\")
- Now we need to add another permission to be able to create calendar events. Click again on Add permissions<\/em>. We return to choose Application permission and<\/em> in the search engine we look for Calendars.ReadWrite.<\/em> We grant permissions again and if everything is correct the permissions will be as follows:
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/graph-12.png\")
Docuo mailing configuration<\/h3>\n\n
- \n
- You must access your R2 Docuo account at https:\/\/myaccount.r2docuo.com<\/a> by entering the credentials of the R2 Docuo repository owner.
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/Graph-15.png\")
- Choose the repository from which you want to send mails through Azure and click in the Actions<\/em> column on theNut button to access its configuration.
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/Graph-14.png\")
- Find the Mail Server section and click on Change mail server:
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/Graph-13.png\")
- Select the option My own mail server<\/em> and choose Office 365 (Microsoft Graph)<\/em> from the list: <\/li>\n\n\n\n
- Enter the data with the Tenant and Customer identifiers and the name<\/em> and e-mail address of<\/em> the service account you wish to use for sending e-mails.<\/li>\n\n\n\n
- Click on send a test mail<\/li>\n\n\n\n
- If everything is correct click Save changes<\/em> and your R2 Docuo repository will be configured and ready to use the specified Office 365 account to send mails.<\/li>\n<\/ol>\n\n
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/image-1-1024x766.png\")
<\/figure>\n\nAdministrators’ Guide: Limiting Mail.Send Permission to a Specific Mailbox<\/h2>\n\n
This procedure ensures that an Azure application, even if it has the Mail.Send<\/strong> permission, can only send mail from mailboxes that are explicitly authorized.<\/p>\n\n
Step 1: Identify the Client ID (ClientID) of the Application<\/h3>\n\n
This information must be obtained from the application registration in the customer’s Azure portal.<\/p>\n\n
- \n
- The customer’s Azure portal must be accessed at(https:\/\/portal.azure.com).<\/a><\/li>\n\n\n\n
- Select Azure Active Directory<\/strong>.<\/li>\n\n\n\n
- Access App<\/strong> registrations.<\/li>\n\n\n\n
- Search and select the application configured for the Docuo service.<\/li>\n\n\n\n
- On theOverview<\/strong> page, copy the application (client) ID<\/strong>, as it will be needed later.<\/li>\n<\/ol>\n\n
Step 2: Create a Mail Enabled Security Group<\/h3>\n\n
A group containing only the e-mail accounts authorized for sending must be created.<\/p>\n\n
- \n
- Access the Exchange Management Center at(https:\/\/admin.exchange.microsoft.com\/).<\/a><\/li>\n\n\n\n
- In the menu on the left, select Groups<\/strong>.<\/li>\n\n\n\n
- Click on Add a group<\/strong>.<\/li>\n\n\n\n
- Choose the group type:“Security enabled for mail<\/strong>“.<\/li>\n\n\n\n
- Group name: Assign a clear and descriptive name to the group, for example: Docuo_Mail_Senders<\/strong>.<\/li>\n<\/ol>\n\n
![\"\"](\"https:\/\/help.r2docuo.com\/wp-content\/uploads\/2025\/07\/microsft-graph-1024x447.png\")
<\/figure>\n\n- \n
- In the Members<\/strong> step, select Add members<\/strong>.<\/li>\n\n\n\n
- Search and select the email account to be used for sending (for example, noresponder@tudominio.com<\/a><\/strong>).<\/li>\n\n\n\n
- In the Setup<\/strong> step, define an e-mail address to identify the group, for example: docuo_mail_senders@tudominio.com<\/a><\/strong><\/li>\n\n\n\n
- Finalize the creation of the group.<\/li>\n<\/ol>\n\n
Once this process is completed, a security group is available that explicitly defines which mailboxes have permission to send.<\/p>\n\n
Step 3: Connect to Exchange Online PowerShell<\/h3>\n\n
The restriction policy can only be created by commands. To do this, you must connect to Exchange Online PowerShell.<\/p>\n\n
- \n
- Open a PowerShell window with administrator privileges.<\/li>\n\n\n\n
- Make sure that script execution is allowed using the following command: Set-ExecutionPolicy -Scope Process RemoteSigned and, if necessary, install the ExchangeOnlineManagement<\/strong> module.<\/li>\n\n\n\n
- Connect to Exchange Online using an administrative account with the command:
Connect-ExchangeOnline -UserPrincipalName <tu_admin_email@dominio.com<\/a>><\/code>. In case you are not previously authenticated, a login window will be displayed. <\/li>\n<\/ol>\n\nStep 4: Create the Application Access Policy (The Key Step)<\/h3>\n\n
Once the connection is established, the policy restricting application access must be created.<\/p>\n\n
New-ApplicationAccessPolicy -AppId “EL_CLIENT_ID_ID_DE_LA_APP” -PolicyScopeGroupId “docuo_mail_senders@tudominio.com<\/a><\/strong>” -AccessRight RestrictAccess -Description “Restrict Docuo application mailing to Docuo_Mail_Senders<\/strong> group members only.”<\/p>\n\n
Command breakdown:<\/p>\n\n
- \n
-AppId<\/code>Application ID (client) obtained in Step 1.<\/li>\n\n\n\n-PolicyScopeGroupId<\/code>: Email address of the security group created in Step 2.<\/li>\n\n\n\n-AccessRight RestrictAccess<\/code>This is the crucial parameter<\/strong>. Tells Exchange that this application can only access mailboxes that are within the group specified at-PolicyScopeGroupId<\/code>.<\/li>\n\n\n\n-Description<\/code>Description of the directive to facilitate its identification by other administrators.<\/li>\n<\/ul>\n\nStep 5: Verify the Configuration<\/h3>\n\n
The configuration should be verified by performing access tests:<\/p>\n\n
1. Tests with a mailbox that DOES need to have access:<\/h5>\n\n
Test-ApplicationAccessPolicy -Identity “noresponder@tudominio.com<\/a><\/strong>” -AppId “EL_CLIENT_ID_DE_LA_APP” -AppId “EL_CLIENT_ID_DE_LA_APP”<\/p>\n\n
The expected result is
AccessCheckResult: <\/code>Condedido.<\/p>\n\n2. Tests with a mailbox that should NOT have access:<\/h5>\n\n
Test-ApplicationAccessPolicy -Identity “otro.usuario@tudominio.com<\/a><\/strong>” -AppId “EL_CLIENT_ID_DE_LA_APP” -AppId “EL_CLIENT_ID_DE_LA_APP”<\/p>\n\n
- Connect to Exchange Online using an administrative account with the command:
- Search and select the email account to be used for sending (for example, noresponder@tudominio.com<\/a><\/strong>).<\/li>\n\n\n\n
- In the menu on the left, select Groups<\/strong>.<\/li>\n\n\n\n
- Select Azure Active Directory<\/strong>.<\/li>\n\n\n\n
- Choose the repository from which you want to send mails through Azure and click in the Actions<\/em> column on theNut button to access its configuration.
- Search and click on the Microsoft Graph<\/em> option
- Unzip the ZIP file and save r2docuo.cer<\/strong> to your hard disk.<\/li>\n\n\n\n
- If the App registrations<\/em> option appears directly ,<\/em> click on it. Otherwise go to search for App registrations in the search bar,<\/em> once located*,* click on the icon*.*.
- An account of your organization with a mailbox on your Exchange Online<\/li>\n<\/ul>\n\n