Configuring Email Settings

You can configure an email server so that you can send an email notification as part of an enforcement set or send a report by email.

To configure Email settings:

1. From the top right corner of any page, click the settings icon. The System Settings page opens.
2. In the Categories/Subcategories pane of the System Settings page, expand External Integrations, and select Email.
3. Send emails (required, default: switched off) — Toggle on to use an Email server. A configured Email server is a prerequisite before you can configure an email notification as part of a configured Enforcement Set or configuring a report to be sent via mail.
4. SMTP gateway — Select the Gateway to use for SMTP.
5. Define the Email host name and Port.
6. SMTP Authentication Type — Select the SMTP Authentication type:
   • Password Authentication
   • Azure Authentication
   • OAuth2 Authentication

Password Authentication

When you choose Password Authentication, you can configure a User name and Password (optional).

Azure Authentication

Select Azure Authentication to send email using MS Graph API, and configure the following settings:

• Client ID — The client ID from the Azure application.
• Client secret — The client secret from the Azure application.
• Tenant ID — The Tenant ID from the Azure application.
• Sender address — Enter a sender address from which the mail will be sent.

For details on generating Azure Client ID, Azure Client Secret and Tenant ID, refer to the Microsoft Entra ID documentation.

Required Permissions

The Entra application must have the following application-level permission: Mail.Send or Mail.Send.Shared.

Mailbox and Licensing Requirements

The sender address does not always require an Exchange Online license:

• User mailbox — must have an Exchange Online license assigned.
• Shared mailbox — can be used without a license (within Microsoft's supported limits). This is the recommended option for service-generated emails.
  Recommendation: Use a dedicated shared mailbox (for example, [email protected]) for Axonius-generated emails.

OAuth2 Authentication

Prerequisites

This method applies only when all of the following are true:

• OAuth authentication is being used with SMTP (not the Graph API).
• Mail is being sent through Microsoft's SMTP relay (smtp.office365.com).
• SMTP AUTH is enabled in Exchange Online for the sending mailbox. SMTP AUTH is disabled by default in many Exchange Online environments and must be explicitly enabled.

Required Permissions

The Entra application must have the following permission: SMTP.Send.

When you choose OAuth2 Authentication, set the following:

• OAuth authentication email — The email for which the OAuth token was created
• OAuth client ID — Azure Client ID
• OAuth client secret — Azure Client secret
• OAuth refresh token — The derived value of creating active tokens from Client ID and Secret ID - see instructions below.
• OAuth URL — The URL to authenticate with and which generates the Access tokens, for example: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

To generate the Azure OAuth2 refresh token, follow these steps:

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?client_id={client_id}&response_type=code&redirect_uri=https://localhost&response_mode=query&scope=https://outlook.office.com/IMAP.AccessAsUser.All%20https://outlook.office.com/SMTP.Send%20offline_access%20openid

https://localhost/?code=0.AQAAB...&session_state=...

curl -X POST "https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id={client_id}" \
  -d "client_secret={client_secret}" \
  -d "code={authorization_code_from_step_1}" \
  -d "redirect_uri=https://localhost" \
  -d "grant_type=authorization_code"

{
  "access_token": "...",
  "refresh_token": "0.AQAAB...",
  "expires_in": 3600,
  ...
}

General Email Configuration

• Use SSL for connection — Configure the connection to be Unencrypted, Verified, or Unverified.
  • When you select the Verified or Unverified options, you can optionally provide the following files, depending on your SMTP server's configuration:
    • CA file — required only if your SMTP server uses a private or self-signed certificate authority not trusted by default. For standard servers such as Microsoft O365 (smtp.office365.com), this is not needed, as their certificates are signed by a publicly trusted CA.
    • Certificate file and Private key — required only if your SMTP server uses mutual TLS (mTLS), which requires the client to present its own certificate. Most standard email servers, including O365, do not require this.
  • When you select the Unencrypted option, the system attempts using TLS when sending emails (the default; no TLS configuration required). If TLS fails and the connection is active (if lost, the system first reestablishes the connection), the system proceeds to send emails without TLS.
• Define the Sender address for all emails sent by Axonius. If empty, the sender address is [email protected].
• Compress email attachments (default: false) — Select this option to compress email attachments. This affects email attachments sent from reports and those sent as part of the Send email Enforcement Set action.
  • When this feature is activated, email attachments are sent as one compressed attachment in zip format.
  • When this feature is not activated, all email attachments are not compressed, and are sent as separate files.