Migrate Microsoft emails to OAuth or IP Relay

An approval request can remain unanswered if its notification never reaches the decision maker. When a process sends emails through a Microsoft account, keeping that account connected is part of maintaining everyday communication.

By the end of this article, you will know how to identify senders that need attention, connect a Microsoft account with OAuth, and prepare an IP Relay alternative with IT. You will also know what to check in email templates and automations before treating the migration as complete.

This article covers outgoing emails sent through a Microsoft account connected to Pipefy. Changing authentication for that connection does not change your access to pipes.

What you will learn:

Identify what needs to change

Basic Auth authenticates an SMTP connection with a username and password. OAuth lets you authorize the connection by signing in to Microsoft. With IP Relay, the server authorizes messages from permitted IP addresses according to the configuration managed by IT.

Sign in to Pipefy as an administrator and open Admin Panel > Apps and channels > Email settings. Identify senders and the default server that use Microsoft credentials. The hosts smtp.office365.com, smtp-mail.outlook.com, outlook.office365.com, smtp.outlook.com and smtp-legacy.office365.com help locate connections to review. Also check the notices displayed on the page.

Record each sender address, the default address, and the templates and automations that use them. For example, purchasing@yourcompany.com might send both quotation requests and approval notifications. The migration needs to cover both uses.

Choose between OAuth and IP Relay

Start with OAuth when your company can authorize sending through a Microsoft account. This option uses Microsoft sign in, without requiring you to enter a host, port, or password in Pipefy’s Microsoft connection. The person configuring it needs administrator access in Pipefy and access to the account being connected.

Consider IP Relay with IT when company policy requires authorization through a server and source IP addresses. This involves preparing the sending infrastructure, authorizing senders, and supplying the connection settings to Pipefy.

An address used by several people, such as support@yourcompany.com, requires an additional check. Ask IT and Pipefy Support to confirm mailbox compatibility and permissions before choosing a connection. A shared address alone does not determine which option to use.

Connect the account with OAuth

Have the Microsoft account that will send messages ready. If the address is already registered with a username and password, read Replace existing senders first and plan the change window.

1. In Email settings, click Connect with Microsoft.
2. For a commercial business account, select the commercial option.
3. Sign in to Microsoft and authorize the connection. If Microsoft requests administrator approval, ask your company’s IT team for help.
4. In the Microsoft Outlook configuration, enter Sender Name and Custom Email Address.
5. Leave the optional pipe for creating cards empty if you only want to configure outgoing email.
6. Click Save and check that the address appears in the sender list. Also check for microsoft_graph in the Host column.

Saving the account registers the connection. To use it in daily operations, check the default sender and the templates that send messages, as explained in the sender replacement section. The Help Center also explains how to connect your Microsoft account with OAuth.

Prepare and configure IP Relay

Before changing anything in Pipefy, ask IT to confirm the applicable sending architecture with Support. This must establish which server will receive messages, which outgoing IP addresses will be authorized, and which domains or senders are permitted.

Gather the following information:

• SMTP host and connection port.
• The server’s encryption requirements.
• Domains and addresses authorized to send messages.
• Source IP addresses confirmed for your company’s environment.
• Confirmation that the server is ready to accept the connection.

The guide to IP based authentication explains the concepts and required information. The list of Pipefy service domains and IPs, in Portuguese can support the technical discussion. Confirm which addresses apply to your company’s outgoing emails before authorizing traffic.

Only after the infrastructure has been validated and is ready, configure Pipefy:

1. In Email settings, open the server configuration.
2. Enter the host and port supplied by IT.
3. Enable SMTP IP Relay and click Save.
4. Add an email address and enter the authorized sender’s name and address.
5. Leave the option to use an SMTP server different from the company default disabled, so this sender uses the default server you configured.
6. Save and repeat for the remaining authorized senders.

If server validation prevents you from saving, ask IT and Support to review the connection settings and authorization. Wait for confirmation before deleting senders that are still in use.

Replace existing senders

Coordinate the change with the people responsible for monitoring emails and choose a period with less sending activity. The proposed migration procedure requires removing the old registration before adding the same address again. During this interval, that address cannot send through the removed configuration.

Before deleting anything, record the senders, server, default address, and relevant templates and automations. For IP Relay, complete the infrastructure preparation described above first.

Move a sender to OAuth

1. Delete the old sender registration using the trash icon in the address row.
2. Register the same address through Connect with Microsoft.
3. If it was the default address, select it again under Set default email.
4. Reopen the templates and automations that used the address and check their sender selection. In the pipe’s email template, review the custom email address setting.
5. Test sending before moving on to the next address.

After migrating all senders, check whether the old SMTP server is still in use. If it has no remaining dependencies, delete the old SMTP server configuration and reload the page to check the result.

Replace the default server with IP Relay

The default server serves all senders associated with it. Plan their migration together:

1. Record and delete the senders linked to the old default server.
2. Delete that SMTP server and reload the page.
3. Configure the new default server with SMTP IP Relay.
4. Register the authorized senders again.
5. Restore the default address, review templates and automations, and test every mapped use.

Test process communications

Use a test card and controlled recipients to check both manual sending and an automation that uses the migrated sender. For a purchasing process, for example, send a quotation message and reproduce the event that triggers an approval notification without contacting real suppliers or approvers.

Check that each message arrived, the sender is correct, and the content matches the expected template. Also check the recipient’s spam folder. If the message is there, the Community discussion about automation emails reaching Outlook spam folders provides additional context about using your company’s domain.

If the test fails, record the sender address, time, pipe, card, and any displayed message. Send that information to Support through a private channel, without passwords or credentials.

Before moving on, confirm that you understand:

☐ Which senders use Microsoft credentials and where they are used.

☐ That OAuth uses Microsoft authorization, while IP Relay requires IT preparation and environment validation.

☐ That replacing a sender registration can require a pause in sending.

☐ That the default address, templates, and automations need checking after the change.

☐ That completion depends on testing receipt of process messages.