Common errors¶

Here you can find some common errors in M365 context. Also have a look at the general M365 documentation for the configuration.

Incorrect Client ID¶

Error message: AADSTS00016: Application with identifier ‘xxxxxxxx’ was not found in the directory ‘MSFT’. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant.

In this case, please compare whether the client ID created in Zammad matches that in Azure for the Azure App.

The Client ID can be found in Zammad under Settings > Channels > Microsoft 365 > App Configuration. See here how to find the client ID in Azure and where to copy it to in Zammad.

Wrong or Expired Client Secret¶

Error message: 500: We’re sorry, but something went wrong.

This error occurs when the client uses an incorrect or expired client secret.

Warning

Important notice: We never ask the client for the client secret as this can potentially be a security risk. We ask the customer to create a new client secret and copy the value and not the ID to Zammad.

See here for more information.

Wrong Tenant¶

Error message: AADSTS0023: Specified tenant identifier ‘xxxxxxxx’ is neither a valid DNS name, nor a valid external domain.

If a wrong tenant is used in Zammad or the email account is not a member of the tenant created in Zammad, this error message occurs.

In this case, please check if the tenant is entered correctly in Zammad, or remove the tenant completely.

Warning

Important notice: Once the tenant is completely removed, all email accounts can be created in Zammad regardless of which tenant the email account is a member of.

Missing Permissions for the Azure User¶

Error message: Can’t use Channel:Driver::SMTPAuthentificationError:Net::SMTPAuthentificationError

Error message in the M365 channel settings¶

or

Error message in the ticket¶

This error occurs when the admin wants to create an email account in Zammad whose user does not have permission for SMTP authentication to the mail server. Please check the following two most common problems in this case.

Private Email Account¶

If it is a private email account, the admin must grant the SMTP authentication permission to the user of the inbox. The permission is provided at https://admin.microsoft.com.

Add the SMTP authentication permission under Users > Active Users > click on the User > Email > Manage Email Apps.

Shared Inbox¶

If it is a shared inbox, you can try to enable the SMTP Authentication (SmtpClientAuthenticationDisabled) in the Azure shell. This isn’t a Zammad problem, so we can only help to a limited extent here.

To enable the SMTP Authentication, use the following commands:

If not installed:

Import-Module ExchangeOnlineManagement

Log in to Exchange using Powershell:

Connect-ExchangeOnline

Switching on the SMTP authentication for a mailbox - also possible with a shared mailbox:

Set-CASMailbox -Identity name@domain.net -SmtpClientAuthenticationDisabled $false

Retrieval of Email Failed¶

Error message: Retrieval using the IMAP4 protocol failed for the following message: […]

This can be caused by Microsoft Defender for Office 365 when Zammad fetches an email while its attachment is still being checked.

To avoid this, you should change the Safe Attachments unknown malware response from “Dynamic Delivery” to something else fitting your needs (e.g. “Block”) for your Office 365 instance.

Authentication Unsuccessful¶

Error message: 535 5.7.3 Authentication unsuccessful

Note

This error message can have different reasons. See description below for one of them.

Microsoft allows sign-in and authentication using the primary email address. While this works for fetching emails, SMTP authentication may not work in this case.

Try to delete the MS account and recreate it using your username. In Zammad, manually change the email address to the username. Then you should be able to send and receive emails again.