[Patrik Skurak]

Hello, we are trying to integrate Microsoft 365 email into our OTOBO instance as a Postmaster email account. We have installed OAUTH add on package, configured Azure on our Microosft 365 instance but we got stuck on redirect URI. Is there any possible way to configure OAUTH without using URI redirect ? This option is not acceptable for us because we don´t want to expose our OTOBO to internet.

[marcel-graf]

Hello Patrik,

which otobo version is being used and have you look into the Docu for the App Registration part in EntraID and Otobo?

https://doc.otobo.de/manual/admin/11.0/en/content/administration-area/communication-notifications/postmaster-mail-accounts.html#pop3-and-imap-oauth2-authentification

KR,

Marcel

[Ma Bi]

Hello,

I think you only need the URI that the „Token“ can be given back to your system.

We used a private IP addresses for testing an this works.

BR.

[Tobias Bück]

Hi Patrik,

you cannot do Microsoft 365 Postmaster OAuth without a redirect URI — that is how Entra returns the authorization code to OTOBO in the usual authorization-code flow. What you can avoid is exposing the whole OTOBO instance on the public internet.

What actually has to be reachable

During one-time setup / re-consent, an admin browser must be able to open the exact redirect URI registered in your Entra app (OTOBO’s OAuth callback). Microsoft redirects that browser there; it is not Microsoft’s servers calling into your network on their own.
That redirect URI can be internal (VPN, LAN, internal DNS name, or — as others reported — a private IP for testing), as long as it matches Entra character for character and the person doing consent can reach it from their browser.
After tokens are stored, IMAP/POP3 fetch is outbound from OTOBO to Microsoft. You do not need ongoing inbound internet access for mail retrieval.

Practical checklist

Entra app registration: redirect URI = what OTOBO shows in Postmaster/OAuth config (including http vs https, host, path).
SysConfig HttpType / FQDN aligned with how that URI is built (mismatch causes weird OAuth failures elsewhere too).
Complete consent from a browser that can reach that URI (VPN if OTOBO is internal-only).
Docs: https://doc.otobo.org/manual/admin/11.0/en/content/administration-area/communication-notifications/postmaster-mail-accounts.html#pop3-and-imap-oauth2-authentification

[Autor]

Beiträge