Choose how to send
Klepsi sends all its emails from a single address. There are two connectors, in Settings, Email tab:
- SMTP: a sending relay, such as Brevo. The simplest option.
- Microsoft 365 (Graph): mail is sent from your Microsoft 365 mailbox and shows up in its Sent Items.
With Microsoft 365, prefer Graph. Password-based SMTP is being phased out there (see below).
Option A: an SMTP relay
Choose the SMTP connector and fill in the fields with what your sending service gives you:
- SMTP server and Port: usually port
587, with STARTTLS ticked. - Username and Password: the relay's credentials. Leave the username empty if the relay does not ask for authentication.
The Sender is the address recipients will see.
With Brevo: server smtp-relay.brevo.com, port 587, STARTTLS ticked. The username and password come from the SMTP page of your Brevo account. The password is an SMTP key, which is different from the API key. The sender's domain must be validated in Brevo, otherwise the emails end up in spam.
With Microsoft 365 over SMTP: server smtp.office365.com, port 587, STARTTLS ticked, and the address and password of a mailbox that has authenticated SMTP sending (SMTP AUTH) enabled.
Option B: Microsoft 365 through Graph
Klepsi signs in as an application, with no user, then sends from the sender's mailbox. You need a Microsoft 365 administrator.
Register the application in Entra
On entra.microsoft.com, open App registrations, then New registration. Name: Klepsi. Select Accounts in this organizational directory only. No redirect URI.
On the application page, note the Application (client) ID and the Directory (tenant) ID.
Grant the Mail.Send permission
In API permissions, add Microsoft Graph, type Application permissions(not delegated), and tick Mail.Send. Nothing else: Klepsi does not read any mailbox.
Then click Grant admin consent. Without this consent, Microsoft refuses to send.
Limit the application to a single mailbox
As it stands, the Mail.Send permission allows sending from any mailbox in the organization. Restrict it to the sender with Exchange Online PowerShell:
Connect-ExchangeOnline
New-ApplicationAccessPolicy -AppId <Application ID> `
-PolicyScopeGroupId klepsi@company.com `
-AccessRight RestrictAccess -Description "Klepsi"
# Check: Granted on the sender, Denied on another mailbox
Test-ApplicationAccessPolicy -Identity klepsi@company.com -AppId <Application ID>
Test-ApplicationAccessPolicy -Identity other@company.com -AppId <Application ID>Microsoft also offers RBAC for Applications in Exchange Online, which is slowly replacing these policies. Either one works. Allow up to an hour, sometimes more, before the restriction applies.
Create a secret and note its expiry
In Certificates & secrets, create a New client secret. Pick the longest expiry offered and note the date. Copy the Value, not the secret ID: it is shown only once.
Before the expiry, create a second secret, paste it into Klepsi, send a test email, then delete the old one.
Fill in Klepsi
Choose the Microsoft 365 (Graph) connector:
- Microsoft tenant: the Directory (tenant) ID.
- Application id: the Application (client) ID.
- Application secret: the value of the secret.
- Sender: the address of the mailbox allowed in step 3.
Test the sending
Click Save, then Send me a test email. The email goes to your own address. The test uses what is saved, not what is on screen.
If it fails, Klepsi shows the code returned, in a French message. With SMTP, "Le relais a répondu 535" means the username or password was refused. With Graph:
- "Azure a refusé la demande de jeton (401)" or (400): wrong tenant, application id or secret, or the secret has expired.
- "Graph a répondu 403 sur sendMail": admin consent is missing, or the sender is outside the restriction from step 3.
Need help?
Our support team can walk you through the setup. Write to us at support@aleop.eu.