Search

Updating Eniteo from EWS to Microsoft Graph

  • Updated
likes

Eniteo uses Microsoft's Exchange Web Services (EWS), through your integrated Microsoft 365 account, to send emails — including invoice and order emails sent from Eniteo to your customers. Microsoft is retiring EWS, so this connection needs to move to Microsoft Graph, Microsoft's replacement service for sending email.

This guide explains how to make that switch. It does not move your mailbox or alter your email address.

Microsoft will start restricting EWS access in Exchange Online in October 2026, then retire it completely in April 2027. Arrange your change before your EWS access ends.

Who needs to help

Two people are required to complete this process:

  • Your Microsoft 365 administrator or IT provider — completes Part 1 to approve access in Microsoft Entra.
  • Your Eniteo administrator, with Enmark Support — completes Part 2 to change the Eniteo settings.

You do not need to complete the Microsoft administrator steps yourself. Send Part 1 to the person who manages your company's Microsoft 365 accounts.

Before you begin

  • Arrange a time when users can stop sending email from Eniteo.
  • Record the current email option, Client ID, and Tenant ID with your administrator before making any changes.

Note: Eniteo sends email from the Microsoft 365 account the user signs in with.

Part 1: Approve access in Microsoft Entra

For your Microsoft 365 administrator or IT provider.

Microsoft Entra ID contains the application settings for this connection. Use the Microsoft Entra admin center to complete these steps.

Step 1: Find the existing Eniteo application

  1. Open the Microsoft Entra admin center.
  2. Sign in with an account authorized to manage the application and approve its permissions.
  3. Select your company's directory. A directory is your company's Microsoft 365 organization.

Screenshot: The Microsoft Entra admin center overview after selecting your company's directory.

  1. Go to Entra ID > App registrations > Owned applications.

Screenshot: The App registrations page with the Owned applications tab selected.

  1. Find the application whose Application (client) ID matches the Client ID recorded from Eniteo.
  2. Open that application.

Screenshot: The Eniteo application's Overview page. IDs are hidden in this example.

Note: Use your existing Eniteo application. Match it by Client ID — do not create a new application registration.

Microsoft application-permission instructions

Step 2: Add the two Graph permissions

  1. Open API permissions.

Screenshot: The API permissions page showing the existing Mail.Read permission.

  1. Select Add a permission.
  2. Select Microsoft Graph.

Screenshot: The Request API permissions panel after selecting Microsoft Graph.

  1. Select Delegated permissions. Do not select Application permissions.

Screenshot: Selecting Delegated permissions for Microsoft Graph.

  1. Find and select Mail.Send.
  2. Find and select Mail.ReadWrite.

Screenshot: The Mail permissions list, with Mail.Send and Mail.ReadWrite selected.

  1. Select Add permissions.

Screenshot: Mail.Send and Mail.ReadWrite selected, ready to add.

Note: If either permission already exists as a Microsoft Graph delegated permission, keep it. Do not add a duplicate.

Microsoft permission setup

The table below describes what each permission grants and why Eniteo requires it:

  • Mail.Send — sends email as the signed-in user. Eniteo requires this to send email.
  • Mail.ReadWrite — reads, creates, updates, and deletes email in the user's mailbox. Eniteo requires this to work with email drafts and attachments.

Note: Both permissions act on behalf of the signed-in user. Mail.ReadWrite applies to the user's entire mailbox, not only to Eniteo messages.

Microsoft permission definitions

Step 3: Approve the permissions

  1. Select Grant admin consent for [your company].
  2. Review the requested permissions.
  3. Confirm the approval.
  4. Refresh the page.
  5. Confirm that both Graph permissions show Delegated and Granted for [your company].

Note: Keep the existing EWS permissions in place during this change. Do not remove them.

Microsoft consent guidance

Step 4: Check the desktop sign-in setup

  1. Open Authentication for the same application.
  2. Check the Mobile and desktop applications configuration.
  3. For the standard Eniteo setup, confirm that the following redirect URI exists: https://login.microsoftonline.com/common/oauth2/nativeclient

This redirect URI tells Microsoft where to return the sign-in result. If the URI is missing, add it under the desktop platform. Keep all other sign-in settings unchanged. This connection does not require a client secret.

Step 5: Give the Eniteo administrator the required values

Open the application's Overview page and copy the following values to give to your Eniteo administrator:

Microsoft application registration guidance

  • Application (client) ID — enters into the Client ID field in Eniteo
  • Directory (tenant) ID — enters into the Tenant ID field in Eniteo

Note: Use the ID values, not the application name or Object ID. The Tenant ID must be the complete identifier containing letters, numbers, and hyphens. Do not enter an email address or a domain name such as company.onmicrosoft.com.

Record the application name, both IDs, the approval date, and the administrator contact. Do not record passwords or sign-in codes.

Part 2: Change the Eniteo settings

For your Eniteo administrator.

Complete Part 1 before starting this section. Ask users to finish sending email and close Print Preview before you begin.

Note: The fields in the screenshots below contain sample data to show the required format. Use your own IDs and work email address — do not copy the sample values.

Step 1: Open Application Control

  1. Go to Maintenance > Application Control.

Step 2: Select Microsoft Graph

  1. Select Exchange Settings.
  2. Under Outgoing Email Protocol, select Microsoft 365 - Graph.

Step 3: Confirm the change

  1. Read the confirmation message. It states that enabling this option will send all notifications from the generating user's Microsoft 365 account rather than a dedicated email address.
  2. Select OK to continue.

Step 4: Confirm the IDs and connect

  1. Confirm that the Client ID matches the value from Part 1, Step 5. If it does not match, enter the correct value.
  2. Confirm that the Tenant ID matches the value from Part 1, Step 5. If it does not match, enter the correct value.
  3. Select Test Microsoft 365.

If Microsoft prompts you to sign in, use your work email account and complete the sign-in steps.

  1. If your work account appears in the list, select it. If it does not appear, select Use another account.
  1. If Microsoft asks for an email address, enter your work email address and select Next. Complete any remaining sign-in steps.

Step 5: Confirm the connection

  1. Review the test result. A successful result displays a message confirming that Graph consent and Drafts access passed for your account.
  2. Confirm that your email account is shown in the result.
  3. Select OK.

Note: This connection check does not send an email.

Step 6: Save the settings

  1. Select Update.
  2. Confirm that the "Record updated" message appears, then select OK.
  3. Close Application Control.
  4. Ask users to close and reopen Eniteo.

Microsoft Graph is now selected as the outgoing email protocol. Users can continue sending email through their normal Eniteo workflow.

Confirm the switch worked

After completing Part 2, use Eniteo's Sendmail feature to send yourself a test email and confirm Microsoft Graph is working:

  1. Go to Billing > Reprint an Invoice by Invoice Number.
  2. Select an invoice.
  3. Select Finish.
  4. On the Recipients tab, enter your own email address in the Email Address field.
  5. Confirm the Email checkbox is selected.
  6. Select Process Row.

Check your inbox. If the email arrives, Eniteo is sending email through Microsoft Graph successfully.

Troubleshooting

The Client ID or Tenant ID is missing or is not a valid GUID

Ask your Microsoft 365 administrator to copy the IDs again from Part 1, Step 5. Enter the complete IDs in Maintenance > Application Control > Exchange Settings. Do not enter an email address or company domain. Select Test Microsoft 365. After a successful result, select Update.

Sign-in fails, or the account or tenant do not match

The error may read "Failed to acquire a token or account" or similar. Complete the following steps:

  1. Select Test Microsoft 365 and complete sign-in with your work email account.
  2. If Eniteo continues to use the wrong account, wait for any email operations to finish. Close Print Preview and Application Control.
  3. In the Eniteo main window, select Clear Office365 Credentials, then select OK.
  4. Open Application Control and select Test Microsoft 365 again. Sign in with the correct work account.

Screenshot needed (Figure 15): Eniteo main window and confirmation dialog, with Clear Office365 Credentials and OK highlighted, noting "Sign in again with your work account." Hide company details and user names.

If sign-in still fails, ask your Microsoft 365 administrator to check the account and the setup completed in Part 1.

The token does not contain all required scopes, or Drafts access fails with HTTP 403

  1. Ask your Microsoft 365 administrator to check the Mail.Send and Mail.ReadWrite permissions on the application from Part 1.
  2. Confirm that both permissions show Delegated and Granted for [your company].
  3. After the administrator corrects the permissions, clear the saved credentials as described above. Sign in again and repeat Test Microsoft 365.

If the error remains, ask the administrator to check mailbox access and company sign-in policies.

Microsoft authorization guidance

The connection test failed, with a connection or timeout error

Ask your IT provider to check the computer's connection to Microsoft 365. Repeat Test Microsoft 365 after the connection is restored. If the message remains, send the error details to Enmark Support.

The email result is unknown, unresolved, or could not be confirmed

Do not send the email again — Microsoft may already have accepted it.

  1. Record the full error message and the Operation identifier, if shown.
  2. Check Sent Items and Drafts in the mailbox used for Eniteo sign-in. Leave any matching messages unchanged.
  3. Contact Enmark Support and wait for confirmation before attempting another send.

Screenshot needed (Figure 16): Print Preview Recipients grid with a sample unresolved-result message, with the Error column and Operation identifier highlighted (use a magnified crop to keep the message readable). Hide recipients and customer details.

Note: When contacting Support, include the error screenshot, the time it occurred, and the action you were performing. Do not include passwords or sign-in codes.