As of: 29 September 2026

Time required: approximately 20 minutes, plus up to 2 hours for Microsoft to apply the permissions

Who this article is for: IT administrators of organisations that use Exchange Online (Microsoft 365) and are connecting their mailboxes to Captured Knowledge (CK).

Expected results: Captured Knowledge can read and work with exactly the mailboxes you release — and no others. No tenant-wide admin consent is needed, and you can verify the restriction yourself.

Captured Knowledge connects to your Exchange Online mailboxes through Microsoft Graph. You grant our application permissions in Exchange Online only for the mailboxes you put into one group ("RBAC for Applications", the method Microsoft recommends).

Overview:

Prerequisites:

Please run the Microsoft Graph commands (recognisable by Mg in the name, e.g. Connect-MgGraph) and the Exchange Online commands (all others) in two separate PowerShell windows; the two modules occasionally interfere with each other's sign-in in the same session.

Our application ("Captured Knowledge Email Connector", application ID fd947736-20c0-45be-ab8b-f1c871926061) is created in your tenant as an enterprise application. No permissions are granted.

The first time, Connect-MgGraph may ask for consent for the Microsoft application "Microsoft Graph Command Line Tools" — that is Microsoft's PowerShell tool, not Captured Knowledge.

If the second command reports that the application already exists (for example because consent was granted earlier), get the object ID like this instead — and please read the note "Earlier admin consent" at the end of this article:

⚠️ Please do not grant admin consent — neither through a consent link nor with the button for granting admin consent ("Grant admin consent") in the Microsoft Entra admin center. A permission granted there applies to all mailboxes in your organisation and cancels the restriction from step 4. It is correct that the enterprise application's "Permissions" page stays empty: Microsoft Entra does not show permissions granted in Exchange Online there.

Captured Knowledge needs a central mailbox that receives the emails to be processed — usually a shared mailbox (no licence, no password) your team already uses. Captured Knowledge also sends replies from this mailbox and creates its working folders in it. Below, [email protected] stands for this mailbox.

Optionally, Captured Knowledge can read further mailboxes, such as individual staff members' personal mailboxes ([email protected]). Captured Knowledge reads and tags these mailboxes and transfers relevant emails into the central mailbox. By default the original then goes to the mailbox owner's Deleted Items; on request it stays where it is, tagged, instead. Captured Knowledge sends no email from these mailboxes and creates no folders in them.

Public folders are not supported through Microsoft Graph. Please use a shared mailbox instead.

The group determines which mailboxes Captured Knowledge may access. Sign in to Exchange Online and create a mail-enabled security group:

Note: only direct members of the group count; nested groups are not considered. A plain Microsoft Entra security group (not mail-enabled) does not work.

First create two scopes (management scopes): all mailboxes in the group, and the central mailbox only. Then register our application in Exchange Online (with the object ID from step 1) and assign the roles to those scopes.

Only if Captured Knowledge reads further mailboxes (step 2), additionally:

Background: this role lets Captured Knowledge transfer an email from a staff member's mailbox into the central mailbox so your team can work on it there. Like all roles here, it applies only to the mailboxes in the group.

Captured Knowledge sends replies from the central mailbox. If the responsible staff member's sender address should appear (for example [email protected]), the central mailbox needs the "Send As" permission for that address. Run this once per sender address:

The mailbox [email protected] does not need to be a member of the group from step 3 for this. If Captured Knowledge only sends with the central mailbox's address, skip this step.

Check the central mailbox, a further mailbox from step 2 (if any) and a mailbox Captured Knowledge must not reach — replace the three addresses with your own:

Expected result:

Note: this check shows the configuration immediately. Microsoft applies it only after 30 minutes to 2 hours.

We do not need any passwords or secret keys.

Adding or removing a mailbox later: add it to the group or remove it from the group. The change takes effect after 30 minutes to 2 hours.

If it is the first further mailbox besides the central mailbox, also assign the role Application MailboxItem.ImportExport (step 4, last command) — otherwise Captured Knowledge cannot take over emails from that mailbox.

Earlier admin consent: if admin consent was granted for our application earlier (for example through a consent link), it still applies to all mailboxes — permissions from Microsoft Entra and from Exchange Online add up. So remove all application permissions granted to our application in Microsoft Entra (Microsoft Graph and Exchange Web Services) — but only after we have confirmed that your connection runs through Microsoft Graph, and no earlier than 2 hours after step 4. While we still read your mailboxes through Exchange Web Services, removing them would interrupt the connection.

An application access policy set up earlier for our application only restricts permissions from Microsoft Entra, so it no longer has any effect; you can remove it with Remove-ApplicationAccessPolicy.

Removing access completely: delete the enterprise application "Captured Knowledge Email Connector" (in the Microsoft Entra admin center or with Remove-MgServicePrincipal -ServicePrincipalId (Get-MgServicePrincipal -Filter "appId eq 'fd947736-20c0-45be-ab8b-f1c871926061'").Id). Exchange Online removes the related role assignments automatically. The scopes and the group remain; if you no longer need them:

IP address: Captured Knowledge accesses Microsoft 365 from the Frankfurt data centre (Google Cloud, europe-west3) through the fixed IP address 34.185.226.196. No firewall rule is needed; the address matters only if you restrict application access to certain IP addresses with Conditional Access.

Troubleshooting:

If you have questions or need help with the setup, write to us at [email protected].