Connect Frappe Helpdesk to a Microsoft 365 Shared Mailbox Without Buying Another User License

RiverdalePro field guide

Tested September 4, 2026 with Frappe Helpdesk, Microsoft 365 through GoDaddy, Exchange Online, OAuth, IMAP, and SMTP.

You can give Frappe Helpdesk a real support@example.com inbox without buying another Microsoft 365 user license. The safe design uses a Microsoft 365 shared mailbox, a licensed user who has permission to access it, and two narrowly configured Frappe Email Account records.

Customer → support@example.com shared mailbox
              ↓ IMAP/OAuth
       Frappe incoming account
              ↓
        Helpdesk ticket
              ↓ SMTP/OAuth
       Frappe outgoing account
              ↓
Customer sees support@example.com

Why two Frappe Email Accounts are required

Frappe uses one Login ID for both incoming and outgoing connections within an Email Account. Microsoft needs two different identities in this design:

• Incoming IMAP: request the OAuth token as the licensed user, but present the shared mailbox address as the mailbox being opened.
• Outgoing SMTP: authenticate as the licensed user and send as the shared mailbox.

One Frappe record cannot safely represent both identities. The tested workaround is:

Outgoing account
Email address: support@example.com
Login ID: licensed-user@example.com
Outgoing only

Incoming account
Email address: support+frappe@example.com  (internal Frappe identifier)
Login ID: support@example.com
Incoming only

Customers still use support@example.com. The plus-address exists only because Frappe requires each Email Account’s Email Address field to be unique. Confirm that plus addressing is enabled in your Microsoft 365 tenant before using this pattern.

Before you connect anything

1. Back up the Frappe database, site configuration, public files, and private files.
2. Stop the Frappe scheduler and mail-processing workers.
3. Make sure the shared mailbox contains no old messages, or only one controlled unread test message.
4. Record the current ticket, contact, assignment, notification, and unsent-email counts.
5. Do not enable automatic retrieval until one manual pull has been inspected.

This containment step matters. A technically valid connection can still point to the wrong inbox and create hundreds of tickets and assignment emails.

Step 1: Create a real Microsoft 365 shared mailbox

In the Exchange admin center, open Recipients → Mailboxes and add a shared mailbox.

Display name: Example Company Support
Address: support@example.com
Mailbox type: Shared mailbox

If the address is already an alias on a user, remove only that alias before creating the shared mailbox. Do not delete or rename the user’s mailbox.

GoDaddy-managed Microsoft 365 tenants can still use the Exchange admin center even when the normal Microsoft 365 admin center redirects to GoDaddy.

Step 2: Grant delegation

Give the licensed user both permissions on the shared mailbox:

• Read and manage (Full Access)
• Send As

Use Send As, not Send on behalf, when customers should see only the Support identity. Permission changes can take time to propagate.

Step 3: Create the Frappe Connected App

Create and save a Microsoft 365 Connected App in Frappe first. Frappe will generate a unique callback URL. Copy that exact HTTPS URL into the Microsoft Entra app registration as a Web redirect URI.

Use a single-tenant app unless you have a specific multi-tenant requirement. Add these delegated scopes in both Entra and Frappe:

offline_access
openid
https://outlook.office.com/IMAP.AccessAsUser.All
https://outlook.office.com/SMTP.Send

Create a client secret and copy the secret value into Frappe. Never place the secret, OAuth tokens, tenant details, or real mailbox content in documentation, screenshots, chat, or source control.

Authorize the Connected App as the licensed Microsoft 365 user who has Full Access and Send As permission. Frappe stores OAuth tokens; this design does not require the shared mailbox to have a password.

Step 4: Configure the outgoing account

Create the first Frappe Email Account:

Account name: Example Company Support
Email address: support@example.com
Authentication: OAuth
Connected App: your Microsoft 365 app
Connected user: licensed-user@example.com

Login ID is different: Yes
Login ID: licensed-user@example.com

Incoming: No
Outgoing: Yes
Default outgoing: Yes
SMTP server: smtp.office365.com
Port: 587
TLS/STARTTLS: Yes
SSL for outgoing: No
Always use account email as sender: Yes

Test outgoing mail directly from Frappe. Confirm the recipient receives it from support@example.com, not from the licensed user’s address.

Step 5: Configure the incoming account

Create a second Frappe Email Account:

Account name: Example Company Support Incoming
Email address: support+frappe@example.com
Authentication: OAuth
Connected App: the same Microsoft 365 app
Connected user: licensed-user@example.com

Login ID is different: Yes
Login ID: support@example.com

Incoming: Yes
Default incoming: Yes
Outgoing: No
Protocol: IMAP
Server: outlook.office365.com
Port: 993
SSL: Yes
Folder: INBOX
Append to: HD Ticket
Sync option: UNSEEN
Create contacts: No during the controlled test
Automatic linking: No during the controlled test

The incoming Login ID is the shared mailbox address. Microsoft documents this shared-mailbox OAuth pattern: obtain the token on behalf of a user, then replace the username in the OAuth connection string with the shared mailbox address.

Step 6: Review SMTP AUTH carefully

SMTP AUTH is a separate Exchange Online control even when the client uses OAuth. Check the organization and mailbox settings before changing them:

Get-TransportConfig |
  Select-Object SmtpClientAuthenticationDisabled

Get-CASMailbox -Identity licensed-user@example.com |
  Select-Object PrimarySmtpAddress,SmtpClientAuthenticationDisabled

The licensed user used for SMTP must not be blocked from SMTP AUTH. The shared mailbox does not need SMTP AUTH because Frappe does not authenticate as it for outgoing mail.

Start with the narrow mailbox override:

Set-CASMailbox -Identity licensed-user@example.com `
  -SmtpClientAuthenticationDisabled $false

RiverdalePro’s GoDaddy-managed tenant was tested with SMTP AUTH disabled by default and one explicit licensed-user exception:

Set-TransportConfig `
  -SmtpClientAuthenticationDisabled $true

Set-CASMailbox -Identity licensed-user@example.com `
  -SmtpClientAuthenticationDisabled $false

Set-CASMailbox -Identity support@example.com `
  -SmtpClientAuthenticationDisabled $true

A mailbox value of False is an explicit exception that allows SMTP AUTH. True blocks it. Null inherits the organization setting, so with the organization set to True, new and unconfigured mailboxes remain blocked by default.

After changing these settings, allow time for propagation and test Frappe’s SMTP authentication without sending a message. If it fails, inspect the effective organization and mailbox values before broadening access.

If Microsoft Entra security defaults are enabled, SMTP AUTH can be blocked. Do not disable security defaults casually. Decide whether equivalent protections exist or whether a different sending method is the better choice.

Step 7: Perform one controlled incoming test

1. Keep the scheduler and background mail workers stopped.
2. Send one message from a known address to support@example.com.
3. Verify that the shared mailbox has exactly one unread message.
4. Run one manual pull for the incoming Frappe account.
5. Confirm exactly one Helpdesk ticket was created.
6. Confirm the sender, subject, queue, assignment, and contact counts are what you expected.
7. Remove or suppress the test-only assignment notification before starting workers.
8. Review the background-job queue. Preserve legitimate cleanup jobs; remove only jobs you can identify as test-only.
9. Mark the controlled message read and verify the shared mailbox has zero unread messages.

Frappe can leave an imported message unread depending on its IMAP behavior. Do not assume the unread flag proves the message was not processed; verify ticket counts and message identity.

Step 8: Restart in a safe order

1. Start the short worker while the scheduler remains stopped.
2. Wait for the existing default queue to reach zero and confirm its jobs succeed.
3. Verify there are no unsent emails.
4. Start the long worker.
5. Start the scheduler last.
6. Wait through at least one mail-polling cycle.
7. Verify ticket count, unread count, unsent mail, and error logs remain stable.

Step 9: Test the full customer conversation

1. Send a new external message to Support.
2. Confirm one new ticket appears and is assigned correctly.
3. Reply from the Helpdesk ticket.
4. Confirm the Frappe Email Queue reaches Sent.
5. Confirm the external recipient sees support@example.com in From and Reply-To.
6. Reply from the external mailbox and confirm the response joins the existing ticket.

A Helpdesk activity entry alone does not prove delivery. Check both Frappe’s mail queue and the recipient mailbox.

Troubleshooting

Frappe imports the licensed user’s inbox

Stop the scheduler and workers immediately. Disable incoming retrieval. Back up Frappe, remove the incorrect tickets and queued notifications, and replace the alias or single-account configuration with the shared-mailbox/two-account design above.

Error 535 5.7.139

Check, in order: outgoing Login ID, mailbox SMTP AUTH, organization SMTP AUTH, Entra security defaults, authentication policies, OAuth scopes, and whether the app was reauthorized after its scopes changed.

Authentication details appear in Frappe Error Logs

Some Frappe email exceptions can capture sensitive OAuth authentication material in a traceback. Limit access to Error Logs, do not copy them into tickets or chats, remove sensitive diagnostic logs after troubleshooting, and reauthorize or revoke the token if you believe it was exposed.

Rollback

To stop mail safely, disable incoming and outgoing on the two Frappe Email Accounts and stop the scheduler before removing permissions. Then:

1. Disconnect or revoke Frappe’s OAuth token.
2. Disable or remove the Entra client secret.
3. Remove the Entra app if nothing else uses it.
4. Remove Full Access and Send As if the user no longer needs the mailbox.
5. Return SMTP AUTH settings to the organization’s approved baseline.

Security and maintenance checklist

• Use OAuth; do not store Microsoft 365 passwords in Frappe.
• Keep the public shared mailbox separate from personal mailboxes.
• Grant only Full Access and Send As to the users who need them.
• Audit every SMTP AUTH exception and disable it everywhere else.
• Rotate the Entra client secret before it expires.
• Review shared-mailbox delegates periodically.
• Monitor shared-mailbox storage and licensing requirements.
• Back up Frappe’s database, files, site configuration, and encryption key.
• Maintain off-server backups and test restoration.
• Retest incoming and outgoing mail after Microsoft, Frappe, or provider changes.

Frequently asked questions

Will this change the licensed user’s email address?

No. The user keeps the same address and mailbox. Delegation does not rename, merge, or forward it.

Why not use an alias?

An alias is only another address attached to an existing mailbox. It does not create a separate inbox. Pointing Frappe at that mailbox can expose ordinary messages to ticket import.

Does the shared mailbox need a password?

No. The licensed user’s OAuth authorization and Exchange permissions provide access.

Is a shared mailbox always free?

No. Microsoft can require a license for storage beyond the included limit and for some archiving, retention, compliance, or security features. Check Microsoft’s current rules for each implementation.

Official references

• Microsoft: About shared mailboxes
• Microsoft: Authenticate IMAP, POP, or SMTP with OAuth
• Microsoft: Enable or disable SMTP AUTH
• Microsoft: Give mailbox permissions to another user
• GoDaddy: Create a shared mailbox
• Frappe: Microsoft 365 Email OAuth
• Frappe Helpdesk: Set up Outlook