Configure Microsoft 365 email in Regal Send
Updated September 20, 2026
Use this guide to configure Microsoft 365 email in Regal Send and send WordPress messages through Microsoft Graph. Regal Send uses an administrator-authorised Microsoft account, requests only delegated Mail.Send and offline access, and stores the resulting credentials in encrypted form. You need permission to create an app registration in Microsoft Entra and an HTTPS WordPress URL before starting.
Before you configure Microsoft 365 email in Regal Send#
- Confirm that the WordPress Address and Site Address use HTTPS.
- Confirm that the normal path-based WordPress REST API works. Query-style REST URLs are not supported for this callback.
- Choose the Microsoft account that will authorise sending.
- Make sure the sender address used by WordPress is permitted for that account. Regal Send does not promise shared-mailbox or send-as support in this release.
The Trial and Premium local test sites use private HTTP addresses, so their Connect Microsoft button is intentionally unavailable. Configure and complete the live authorisation on an HTTPS WordPress environment.
Create the Microsoft Entra app registration#
- Open the Microsoft Entra admin centre and go to App registrations.
- Create a new registration and enter a recognisable name such as Regal Send for your website.
- Select the supported account type you intend to use. This must match the authority selected later in Regal Send.
- Complete the registration and copy the Application (client) ID from the app overview.
Regal Send supports work, school and personal accounts, work and school accounts only, personal accounts only, or one specific tenant. For a tenant-specific connection, copy the Directory (tenant) ID or use a verified tenant domain such as contoso.onmicrosoft.com.
Add the exact Redirect URI#
- In WordPress, open Regal Send > Settings.
- Select Microsoft 365 / Outlook.
- Copy the read-only Redirect URI shown by Regal Send.
- In the Entra app registration, open Authentication and add a Web platform.
- Paste the exact Redirect URI and save it without changing the path or adding query parameters.
The callback ends in /wp-json/regal-send/v1/oauth/microsoft/callback. Microsoft must return to the same scheme, host, port and path displayed by Regal Send. If your site URL changes, update the Entra registration before reconnecting.
Add the delegated Mail.Send permission#
- Open API permissions in the Entra app registration.
- Select Add a permission, Microsoft Graph, then Delegated permissions.
- Add Mail.Send.
- Grant administrator consent only if your organisation requires it.
Do not add application Mail.Send, mailbox-read scopes or directory-read scopes for Regal Send. The plugin sends as the signed-in account through /me/sendMail and does not read the mailbox. See Microsoft’s Mail.Send permission reference for current permission details.
Create and save the client secret#
- Open Certificates & secrets in the Entra app registration.
- Create a new client secret with an expiry appropriate for your organisation.
- Copy the secret Value immediately. Do not copy the Secret ID.
- Return to Regal Send and enter the Application (client) ID, account authority and client secret value.
- Select Save settings.
A saved secret is never returned to the browser. Regal Send shows a saved status beside an empty replacement field. Entering a new value replaces it; selecting the separate removal option removes it when settings are saved.
Connect the Microsoft account#
- After saving the app details, select Connect Microsoft.
- Sign in with the account that should authorise sending.
- Review and grant the requested access.
- Allow Microsoft to return to WordPress.
- Confirm that Regal Send shows Connected.
The authorisation flow uses a one-time state value and PKCE. Regal Send stores encrypted access and refresh tokens, refreshes access when needed and removes local tokens when you disconnect. Microsoft Graph returning HTTP 202 means the transport accepted the request; it does not prove delivery to the recipient inbox.
Understand Microsoft connection states#
- Not configured: add valid app details, correct the callback environment, then save.
- Awaiting authorisation: complete Microsoft sign-in and consent, or reconnect to start again.
- Connected: a refresh token is saved and no current authentication error is recorded.
- Authentication problem: consent, credentials or refresh access is no longer usable. Reconnect the account.
Opening the settings page does not make a remote Microsoft request. The status changes only after a save, connection, callback, refresh, send or disconnect action.
Troubleshoot common connection problems#
Connect Microsoft is unavailable#
Check that the WordPress site uses HTTPS, that the callback is path-based, and that a valid client ID and client secret value are saved. The button remains unavailable on an HTTP site by design.
Microsoft rejects the client credentials#
Confirm the Application ID, replace the saved client secret with its Value, and check that the secret has not expired. A secret ID is not a usable secret value.
Consent is denied or Mail.Send is missing#
Return to API permissions, confirm delegated Mail.Send is present, satisfy any tenant administrator-consent policy, then reconnect. Regal Send rejects a token that does not include Mail.Send.
The connection later shows Authentication problem#
The refresh token may have expired or been revoked. Select Reconnect Microsoft and complete sign-in again. If the app authority or tenant changed, save the matching settings before reconnecting.
Microsoft accepts the message but it does not arrive#
An accepted result records transport acceptance only. Check the recipient address, junk folder, Microsoft message trace, tenant policies and the sender’s permission to use the configured From address. The Microsoft Graph sendMail documentation explains the accepted response.
Disconnect or replace the integration#
Select Disconnect to delete Regal Send’s local Microsoft access and refresh tokens while keeping the app ID, authority and saved client secret. Use Reconnect when consent or refresh access must be renewed. To stop the app at Microsoft as well, remove its consent or registration through your organisation’s Microsoft account controls.
