Email server settings

ManageEngine SecureAI sends email for the work it generates, including the notifications raised by the templates you define and alerts about the product itself, such as license expiration and server downtime. Email server settings give SecureAI an account to send from, and until that account is in place, no feature that notifies people can reach them. Come back to email server settings when the sending mailbox changes, when your organization moves off password authentication, or when messages stop reaching recipients.

How it works

SecureAI sends a message when a notification template or a product alert raises one. It puts the configured sending address on the message and signs in to the mail service, either with a user name and password or with an access token from Microsoft or Google. A token is issued to one account, and that account has to be allowed to send as the sending address. SecureAI then hands the message over.

In SMTP mode, it connects to the mail server and port you gave and passes the message to it, encrypted or not depending on the connection security you chose. In API mode it calls the provider over HTTPS and the provider sends the message. The mail service takes over from there, so a message can still be delayed or rejected after SecureAI has handed it on.

Every feature that emails uses this one configuration, so a change here changes the sender for all of them. A message raised by a notification template goes to the recipients that template names. An alert about SecureAI itself goes only to the administrator addresses. A test email uses the values currently entered and takes the same path a real message takes, so a failed test means the email configuration is wrong rather than the template.

Prerequisites

• Log in with a role that includes the Server Settings permission under Administration. Of the roles supplied with SecureAI, Super Admin and Governance Manager include it.
• For SMTP, obtain the hostname and port of your mail service from the team that runs it.
• For SMTP, confirm that the SecureAI server can reach that host on that port through any firewall between them. For API, confirm that it can reach the mail provider over HTTPS.
• Prepare a sending mailbox for the From Address that your mail service permits SecureAI to send as.
• For basic authentication, obtain the username and password of an account that is allowed to relay through the mail service.
• For Microsoft, register an application in Microsoft Entra ID, grant it permission to send mails, and record the tenant ID, client ID, and client secret.
• For Google in SMTP mode, create an OAuth client in your Google project, enable the Gmail API, and record its client ID and client secret.
• For Google in API mode, create a service account, enable the Gmail API for the project, grant the service account domain-wide delegation, and download its JSON private key.
• Have an address ready for Administrator's Email Address, which SecureAI requires before the configuration can be saved or tested.

Basic authentication needs nothing set up at the mail provider. OAuth and API access do, and the sequences below cover that setup for each mode and provider. Complete the one that matches how you send, then configure SecureAI.

• Using SMTP
• Using API

Configure the mail provider for SMTP

OAuth in SMTP mode signs in with a token your mail provider issues. What you set up to get that token differs by provider, so follow the sequence for the one you use.

Note: If you register only the localhost form, you have to reach SecureAI on localhost to configure the email server.

• OAuth with Microsoft Entra ID as your email provider
• OAuth with Google as your email provider

Microsoft Entra ID

Registering the application produces the client ID, tenant ID, and client secret that SecureAI presents when it requests a token.

1. Sign in to the Azure portal and click Microsoft Entra ID > App registrations > New registration.
2. Enter a name for the application and keep the default account type, Accounts in this organizational directory only.
3. Select Web as the platform and enter one of the following as the redirect URI.
   • https://identitymanager.manageengine.com/api/public/v1/oauth/redirect
   • protocol://localhost:port_number/context_if_any/RestAPI/WC/OAuthSetting
4. Click Register, then copy the Application (client) ID and the Directory (tenant) ID.
5. Click Certificates & secrets > New client secret, enter a description and an expiry, and click Add.
6. Copy the secret value while it is shown. It cannot be retrieved later.

The client ID, tenant ID, and secret go in Client ID, Tenant ID, and Client Secret under Authentication.

Google

Creating an OAuth client in your Google project produces the client ID and client secret that SecureAI presents when it requests a token.

1. Sign in to the Google Cloud console and select or create a project.
2. Click APIs & Services > Library, search for Gmail API, and enable it.
3. Click OAuth consent screen, enter an application name and a support email, and select the audience type. Select External if your organization does not use Google Workspace.
4. Add the scope https://mail.google.com/.
5. Click Credentials > Create Credentials > OAuth client ID, select Web application, and enter a name.
6. Enter one of the following under Authorized redirect URIs.
   • https://identitymanager.manageengine.com/api/public/v1/oauth/redirect
   • protocol://localhost:port_number/context_if_any/RestAPI/WC/OAuthSetting
7. Click Create, then copy the client ID and the client secret.

Both values go in Client ID and Client Secret under Authentication.

Prepare the mail provider for API

API mode calls the provider's sending interface instead of signing in to a mail server, so no redirect URI is involved. Follow the sequence for the provider you use.

• Microsoft Entra ID
• Google

Microsoft Entra ID

The application sends mail on its own behalf, so it needs permission to send and the consent of an administrator.

1. Sign in to the Azure portal and click Microsoft Entra ID > App registrations > New registration.
2. Enter a name for the application and keep the default account type.
3. Click Register, then copy the Application (client) ID and the Directory (tenant) ID.
4. Click API permissions > Add a permission > Microsoft Graph > Application permissions, select Mail.Send, and click Add permissions.
5. Click Grant admin consent for your tenant. The permission is not in force until consent is granted.
6. Click Certificates & secrets > New client secret, enter a description, set the expiry to 24 months, and click Add.
7. Copy the secret value while it is shown. It cannot be retrieved later.

The client ID, tenant ID, and secret go in Tenant ID, Client ID, and Client Secret alongside the other email server values.

Google

A service account sends mail on behalf of users in your domain, so it needs a private key and a delegation granted across the domain.

1. Sign in to the Google Cloud console and select or create a project.
2. Click Service Accounts > Create service account, enter a name, an ID, and a description, and grant the roles your organization requires.
3. Select the service account, click Keys > Add key > Create new key, select JSON, and click Create. The key file downloads to your machine.
4. Click APIs & Services > Enable APIs and services, search for Gmail API, and enable it.
5. Sign in to the Google Admin console as a super administrator and click Security > Access and data control > API controls.
6. Under Domain wide delegation, click Manage domain wide delegation > Add new.
7. Enter the client ID of the service account, enter https://mail.google.com as the scope, and click Authorize.

The key file goes in Upload JSON Private Key. Store it somewhere your organization controls, because it grants the ability to send as users in your domain.

Configuration instructions

1. Navigate to Settings > General Settings > Server Settings.
2. Click Email Server/SMS Gateway > Email Server.
3. Select the value for Mode, then follow the steps for it.
   • SMTP relays through a mail server you run or subscribe to.
   • API sends through the Microsoft or Google sending interface.

Configure SMTP

1. Enter the hostname or IP address of the mail server in the Email Server field.
2. Enter the port the mail service listens on in the Email Port field.
3. Enter the address SecureAI sends from in the From Address field.
4. Click Authentication and select a value for Authentication Type.
   • Basic Authentication: Enter the username and password of a mailbox that is allowed to relay through the mail service. Leave both empty if the mail service accepts unauthenticated relay from the SecureAI server.
   • OAuth Authentication: Select the mail service in the Mail Provider field and enter the values listed in the following table.

1. Click Configure to apply the authentication details and return to the email server values.
2. Enter the addresses that receive alerts about SecureAI itself, such as server downtime and license expiration, in the Administrator's Email Address field. Separate multiple addresses with commas.
3. Select the value for Connection Security, which sets how the session with the mail server is encrypted.
   • NONE: No encryption.
   • SSL: Encrypts the session with SSL.
   • TLS: Encrypts the session with TLS.
4. Click Send Test Email and confirm that the message reaches the addresses you entered.
5. Click Save Changes.

Configure API

1. Select the provider that hosts your mail in the Mail Provider field.
2. Enter the address SecureAI sends from in the From Address field.
3. Enter the addresses that receive alerts about SecureAI itself, such as server downtime and license expiration, in the Administrator's Email Address field. Separate multiple addresses with commas.
4. Enter the credentials of the application you registered with the provider.
   • Microsoft: Enter Tenant ID, Client ID, and Client Secret.
   • Google: Click Browse next to Upload JSON Private Key and select the private key file generated for your service account.
5. Click Send Test Email and confirm that the message reaches the addresses you entered.
6. Click Save Changes.

Tips

• Use OAuth or API access rather than a user name and password. Microsoft and Google have been withdrawing basic authentication from their mail services, so a password that works today may stop working without warning.
• Send from a mailbox created for the product rather than from an administrator's own address, so notifications survive staff changes and replies land somewhere that current staff can read.
• Match the port to the connection security you select. Mail services commonly listen on 25 for unencrypted sessions, 465 for SSL, and 587 for TLS, and a mismatch usually appears as a test mail that never completes.
• If a test mail fails after an OAuth configuration, check that the account in the User Name field is the same one that consented to the registered application. A token issued to a different account is refused by the mail service even though every value looks correct.
• Treat the alert recipients as an operational address list rather than a personal one. Those messages arrive when SecureAI is stopped or its license has lapsed, which is when a single unattended mailbox is least useful.
• Who receives a given notification, and what it says, is set in the notification template that sends it. Change the template if the wrong people are being emailed, and change the email configuration only if nothing is arriving at all.