For using the Directory Synchronisation in seppmail.cloud, an app must be set up in Azure.

Proceed as follows:

1. Log into the Azure Portal with an M365 administrator with privileges to create applications for the tenant and domain(s) in question.
2. Go to Entra ID > App Registrations > New registration.  
3. Give the new application a name (for example "seppmail.cloud directory synchronisation").
4. Select account type Only accounts from this organisation, leave redirect URL empty and click on Register.
5. The app registration is created and the details are shown. Copy the application (client) ID to a temporary place.
6. Click on Add certificate or secret, then under Secret Client Keys click on New secret client key.
7. For the name of the key, use something like "seppmail.cloud yyyy-mm-dd", and select the validation period and click on Add.
   • Immediately after the client secret is created, you have to copy the secret value to a temporary place. It will not be shown to you again.
   • Note that if you provide the correct validation period in the seppmail.cloud configuration later, we will send you a reminder about renewing this client secret.
8. In the left-hand menu, select API privileges and click on Add privileges.
9. Select Microsoft Graph as the category and Application permissions for privileges to add.
10. Add the following access rights:
    • Domain.Read.All
    • Group.Read.All
    • GroupMember.Read.All
    • User.Read.All
11. You must confirm Admin consent for the API privileges. Example for a resulting list of privileges:
    

After you created the privileges, check that the groups you want to synchronise exist and have group members assigned. At least one group with at least one member has to exist for synchronisation.

At this point, open the seppmail.cloud portal and continue with the configuration as described in Directory Synchronisation.