**As** Begin of the insertionan administratorEnd of the insertion Begin of the deletion a \[enter role of user\]End of the deletion
**I want to** Begin of the insertionconfigure OAuth client credentialsEnd of the insertion Begin of the deletion \[enter objective\]End of the deletion
**so that** Begin of the insertionI can use the inbound email feature with IMAP servers that support the OAuth client credentials flow - for example Microsoft Exchange.End of the insertion Begin of the deletion \[enter desired result\]End of the deletion

Begin of the insertionThe inbound emails feature is not usable with a Microsoft Exchange email server without this!

End of the insertion **Acceptance criteria**

* Begin of the insertionAuth method can be chosen from

* Basic Auth (username & password)

* OAuth

* When OAuth is chosen it's possible to either

* Custom:

* enter client\_id, client\_secret, token\_url and scope

* Use existing OpenID provider configuration

* choose from list of existing OpenID provider

* Bonus: Pre-fill known values when specific email servers are chosen

* When choosing OAuth the following options are shown

* Microsoft Exchange

* Use existing OpenID provider configuration

* Custom

* When choosing Microsoft Exchange, pre-fill

* token\_path (NOT URL) `/oauth2/v2.0/token`

* We'd need to make it obvious that the admin needs to set the full URL, maybe it's better not to pre-fill this at all.

* scope [`https://outlook.office.com/IMAP.AccessAsUser.All`](https://outlook.office.com/IMAP.AccessAsUser.All)


End of the insertion Begin of the deletion <br>


End of the deletion **Technical notes**

* Begin of the insertionUse [client credential flow](https://www.oauth.com/oauth2-servers/access-tokens/client-credentials/)

End of the insertion Begin of the deletion <br>


**Permissions and visibility considerations**

End of the deletion * Begin of the insertionWhen an existing OpenID providerEnd of the insertion Begin of the deletion _To whomEnd of the deletion is Begin of the insertionchose, we&#39;ll request a token from the OAuth Client chosen provider and inject the scope required for IMAP access

End of the insertion Begin of the deletion this feature visible?_

End of the deletion * Begin of the insertionQuestion: How do we store the correct scope to inject for this flow? The OpenID providerEnd of the insertion Begin of the deletion _WhenEnd of the deletion is Begin of the insertionconfigured with some scopes, but we&#39;ll need different scopes to get the emails via IMAP. Those scopes areEnd of the insertion Begin of the deletion itEnd of the deletion not Begin of the insertion(completely) standardised, so users will need to be able to set them. &nbsp;


**Permissions and visibility considerations**

* AdministratorsEnd of the insertion Begin of the deletion visible?_End of the deletion


**Translation considerations**

* Begin of the insertionDon&#39;t translate

* _Basic auth_

* _OAuth_

* _Client ID_

* Client secret

* Token URL

* Scope


End of the insertion Begin of the deletion _Key terms and phrases in the key languages_&nbsp;


End of the deletion **Out of scope**

* Begin of the insertionOAuth with authorization code flow for OAuth, as used by GmailEnd of the insertion Begin of the deletion <br>


_Set the_ **To be informed/consulted teams** _field to include all teams necessary to be informed of the changes._End of the deletion