Azure

1. Register the application in Azure by referring to this document.
2. After registration, you can view clientID and tenantID in Overview.
3. For Client secrets, you can manually add them in Certificates & Secrets.
4. For sending mails, you need to add Mail.Send permission. For more information, see this document.

The recommended methods for obtaining tokens are auth code flow and client credentials flow

Auth code flow requires the user to log in interactively, and the application can only send emails on behalf of the logged in user.

Client credentials flow does not require the user to log in, but requires the administrator to grant the application permission Mail.Send, which can send messages on behalf of any user. (Most users will want this option as it's a bit simpler.)

Microsoft Graph / Entra ID

Register an Application in Entra ID

1. Open Microsoft Entra Admin Center as a Global Admin or a Cloud Application Admin.
2. Navigate to Identity > Applications > App registrations.
3. Click 'New registration'.
4. Give it a name such as "Snipe-IT Mail".
5. Leave the default single-tenant setting.
6. Click Register.
7. Make note of the Application (Client) ID and Directory (Tenant) ID.

Create a Client Secret

1. In the app registration, go to Certificates & secrets.
2. Click 'New client secret'.
3. Set an expiration period.
4. Make note of the secret value immediately (it will not be shown again).

Grant Mail.Send Permission

1. In the app registration, go to API Permissions
2. Click 'Add a permission'
3. Select 'Microsoft Graph'
4. Select 'Application permissions'
5. Search for 'Mail.Send'.
6. Click 'Add permissions'
7. Click 'Grant admin consent for
8. Click 'Yes'.

Restrict Access (Recommended)

By default, Mail.Send application permission can send as any mailbox in your tenant. Create an Exchange Online Application RBAC assignment so the app can only send as a dedicated mailbox. The following script creates an RBAC policy and assigns it to a mail-enabled security group. This allows easy changes to the Snipe-IT mailbox in the future.

Open a PowerShell window and insert the correct values for your instance in the script below, then paste it in the PowerShell window:

$snipeItSgName  = ""     # Snipe-IT security group name
$snipeItSgEmail = ""     # Snipe-IT security group email address
$snipeItEmail   = ""     # Email address from which Snipe-IT can send email
$clientID       = ""     # Application/Client ID for Snipe-IT (from the App Registration overview page)
$objectID       = ""     # Enterprise Object ID for Snipe-IT (from the Enterprise App overview page)

# Connect to Exchange Online as a Global Admin or Exchange Admin
Connect-ExchangeOnline

# Create a mail-enabled security group to assign these permissions to
New-DistributionGroup `
    -Name $snipeItSgName `
    -Type Security `
    -PrimarySmtpAddress $snipeItSgEmail

# Add your Snipe-IT mailbox to the security group
Add-DistributionGroupMember `
    -Identity $snipeItSgName `
    -Member $snipeItEmail

# Create the management scope for the security group
New-ManagementScope `
    -Name "SnipeITScope" `
    -RecipientRestrictionFilter "MemberOfGroup -eq '$snipeItSgEmail'"

# Create the service principal for Snipe-IT
$sp = New-ServicePrincipal `
    -AppId $clientID `
    -ObjectId $objectID `
    -DisplayName "Snipe-IT"

# Create the management role assignment for Snipe-IT
New-ManagementRoleAssignment `
    -Name "SnipeIT-MailSend" `
    -Role "Application Mail.Send" `
    -App $sp.Identity `
    -CustomResourceScope "SnipeITScope"

Verify with Get-ManagementRoleAssignment -Identity "SnipeIT-MailSend" and Get-ServicePrincipal -Identity "Snipe-IT".

Configure Snipe-IT

Place the following environment variables in your docker-compose.yml file or .env file:

MICROSOFT_GRAPH_CLIENT_ID # Entra App Registration overview page
MICROSOFT_GRAPH_CLIENT_SECRET # Entra App Registration client secret
MICROSOFT_GRAPH_TENANT_ID — # tenant id
MICROSOFT_GRAPH_FROM_ADDRESS — # mailbox the app is RBAC-scoped to send from

Then clear the Snipe-IT configuration cache and restart the web server or container:

php artisan config:clear # Bare metal install
docker exec -it <container_name_or_id> php artisan config:clear  # Docker install

Google Workspace

To send via API from your Google Workspace account, see this excellent tutorial from Mailtrap. You'll want the "Send email in Laravel using Gmail API" section.

Gmail SMTP

This should generally work as expected, using a mail config like below:

MAIL_MAILER=smtp
MAIL_HOST=smtp.gmail.com
MAIL_PORT=465
[email protected] 
MAIL_PASSWORD=*************
MAIL_ENCRYPTION=tls
[email protected]
MAIL_FROM_NAME="${APP_NAME}"

There are a few limitations to sending email with Gmail:

• Sending limit – With Gmail SMTP, users have a daily email sending limit, which depends on the Gmail account they use. Exceeding this limit will cause errors or a temporary suspension.
• Rate limit – Another limit Gmail SMTP users have to deal with is the limit on how many emails they can send per minute or per hour. Exceeding this limit will block or delay your email sending.
• Security – Sending emails through Gmail SMTP will require a secure connection such as SSL or TLS, which you need to configure correctly in the Gmail SMTP settings. Failing to do so will leave your emails and their data vulnerable to interception and tampering.
  Google’s security settings also require proper configuration of things such as two-factor authentication to avoid the blocking of email sending.
• Custom domain – For sending emails from a custom domain such as 'yourcompany.com` with Gmail SMTP, you need to configure the correct DNS settings. Not doing so will cause your emails to fail SPF, DKIM, and DMARC authentication checks and thus be marked as spam or simply rejected.