MountainGoat · Email Sync

Outlook Email Sync (Microsoft Entra): MountainGoat Configuration Guide

For Microsoft Entra administrators connecting a Microsoft 365 purchase-order mailbox to a MountainGoat instance.

This guide walks you through authorizing MountainGoat to read purchase-order email from one Microsoft 365 mailbox you choose. At a glance:

Read-only access. The mail permission requested is delegated Mail.Read. MountainGoat cannot send, delete, or change any message, and it never sees a password.
You configure the integration in two places: the Microsoft Entra admin center (register the app) and the MountainGoat Admin UI (paste the credentials).
You hold the kill switch. Your admin can revoke the connection at any time from your own console, without involving MountainGoat.

Looking for sign-in instead? This guide covers reading a purchase-order mailbox. To let your team sign in to MountainGoat with Entra, including SCIM user provisioning, see the Microsoft Entra ID SSO & SCIM guide. The two use separate app registrations.

1.Overview

MountainGoat finds purchase orders in a designated mailbox and turns them into structured, reviewable orders. To do that it needs read-only access to one Microsoft 365 mailbox, granted through Microsoft's standard OAuth 2.0 consent flow using the delegated authorization-code grant (Web, confidential client).

Three steps share the work:

Your Entra administrator registers an application in your own tenant and grants admin consent (sections 3 to 5).
A MountainGoat administrator enters the Client ID, Tenant ID, and Client Secret in the MountainGoat Admin UI (section 6).
The mailbox owner clicks Connect Outlook and approves Microsoft's consent screen (section 7).

Because this is the delegated flow, MountainGoat can only ever reach the mailbox of the account that signs in during the connection step. There is no tenant-wide access.

2.Prerequisites

Entra administrator role: Application Administrator, Cloud Application Administrator, or Global Administrator (required to register the app and grant admin consent).
Your MountainGoat subdomain. Each production MountainGoat instance is reachable at https://{app.subdomain}.mountaingoat.ai. Throughout this guide, {app.subdomain} is a placeholder for your subdomain label. Replace it everywhere it appears with your own label (for example acme, producing acme.mountaingoat.ai).
The purchase-order mailbox. The identity of the single mailbox MountainGoat will read.
A MountainGoat administrator account to enter the credentials in the MountainGoat Admin UI.

Time required: about 15 minutes.

3.Register the application

Sign in to the Microsoft Entra admin center at https://entra.microsoft.com (or https://portal.azure.com → Microsoft Entra ID).
Go to Identity → Applications → App registrations → New registration.
Name the application, for example MountainGoat PO Intake.
Supported account types: Accounts in this organizational directory only (Single tenant).
Under Redirect URI, choose platform Web and enter the value below, replacing {app.subdomain} with your subdomain label.
Click Register, then copy the Application (client) ID and the Directory (tenant) ID from the Overview page.

Redirect URI (Web) https://{app.subdomain}.mountaingoat.ai/api/oauth/outlook/callback

The redirect URI must match character for character. A trailing slash or http:// instead of https:// will make the connection fail. Copy and paste it.

4.Add the read-only mail permissions

In the app, go to API permissions → Add a permission → Microsoft Graph → Delegated permissions.
Add all three: Mail.Read, User.Read, offline_access.
Click Grant admin consent for [your tenant] and confirm, so users are not individually prompted and the grant stays under admin control.

Permission	Why MountainGoat needs it
`Mail.Read`	Read purchase-order email from the connected mailbox. Read-only: no send, delete, or modify.
`User.Read`	Identify the signed-in mailbox account during the connection step.
`offline_access`	Keep the mailbox synced with a refresh token instead of asking the owner to sign in repeatedly.

5.Create the client secret

In the app, go to Certificates & secrets → Client secrets → New client secret.
Add a description, for example MountainGoat, and choose an expiry of 12 or 24 months.
Click Add, then copy the Value column immediately. It is shown only once.

Calendar the secret expiry. When the client secret expires, the mailbox connection stops until a new secret is created and entered in MountainGoat. Set a rotation reminder 30 days before the expiry date.

6.Enter the credentials in MountainGoat

Click Settings under the user profile.
Select the Admin tab → API & Credentials → Email Credentials → Outlook / Microsoft Graph Configuration.

MountainGoat field	What to enter
Client ID	The Application (client) ID from section 3.
Client Secret	The client secret Value from section 5. Stored encrypted and never displayed back. See the note below.
Tenant	The Directory (tenant) ID from section 3. Required for a single-tenant registration.
Redirect URI	`https://{app.subdomain}.mountaingoat.ai/api/oauth/outlook/callback`. Must match the Web redirect URI in Entra exactly.
Scopes	`offline_access User.Read Mail.Read`. This is the default; leave it as is.

About the Client Secret. The secret is write-only in the Admin UI: you can enter or replace it, but MountainGoat never displays it back and stores it encrypted. On a later edit, leave the Client Secret blank to keep the existing secret. Only type in the field when you intend to replace it.

On a managed instance, MountainGoat can enter the credentials for you. Send them through a password manager share, a one-time secret link, or read them over a phone call, and include the secret's expiry date. Never put a client secret in the body of a normal email or chat message. If one ends up in an email thread, tell us and we will help you rotate it in minutes.

Click Save Outlook Config when you are done.

7.Connect the mailbox

The person who owns the purchase-order mailbox completes the one-time connection:

Sign in to MountainGoat and go to Settings → Admin → Setup → Inbox Connections.
Click Connect Outlook.
Sign in as the purchase-order mailbox account (or an account with delegated access to it) and approve Microsoft's read-only consent screen.

MountainGoat stores an encrypted refresh token and begins read-only sync of that mailbox. Because this is the delegated flow, access is limited to the mailbox of the account that signs in here.

8.Recommended hardening (optional)

Conditional Access. Create a policy targeting this app that restricts where the connection may be used from, so a token cannot be used elsewhere.
Monitoring. Review activity any time under Enterprise applications → [your app] → Sign-in logs.
Instant revocation. Enterprise applications → [your app] → Permissions → Revoke, or delete the app registration. Access stops immediately.
Secret rotation. Rotate the client secret before expiry. MountainGoat keeps using the existing secret until a new one is entered.

A note on mailbox scoping. You may see Exchange Application Access Policy referenced as a way to limit access to a single mailbox. That control applies to application (app-only) permissions and is not required here: MountainGoat uses the delegated flow, so access is already limited to whichever mailbox account signs in during section 7.

9.Troubleshooting

Symptom	Cause	Fix
Microsoft shows a redirect URI mismatch error (`AADSTS50011`)	The redirect URI in Entra does not exactly match the one MountainGoat sends.	Compare both values character for character, including `https://` and no trailing slash, in Entra and in the MountainGoat Redirect URI field.
Users are prompted for approval they cannot grant	Admin consent was not granted for the delegated permissions.	Click Grant admin consent in API permissions (section 4).
Sign-in fails with an audience or tenant error	The Tenant field in MountainGoat does not match the single-tenant registration.	Set the Tenant field to your Directory (tenant) ID and save.
Sync worked, then stopped	The client secret expired, or the grant was revoked.	Create a new secret (section 5), enter it in MountainGoat, and reconnect if needed (section 7).

10.Security and privacy notes

Read-only scope. The mail permission is delegated Mail.Read. MountainGoat cannot send, delete, or modify mail, and it never receives a password.
One mailbox, single tenant. The app registration is single tenant and the delegated flow only ever reaches the mailbox of the account that signs in during section 7.
Secrets stay on the backend. The Client Secret field is write-only in the Admin UI. Credentials and tokens are stored encrypted and are never returned to a browser.
Instant revocation. Revoke the permission grant or delete the app registration in Entra. Access stops immediately.
Certificate option. A certificate may be uploaded instead of a client secret for stronger authentication. Ask us during onboarding if your security team prefers it.

11.Support

For help connecting Outlook to MountainGoat, contact:

help@mountaingoat.ai

See also the companion Gmail setup guide and the Sign in with Okta configuration guide.