Email via OAuth with Microsoft 365 or Gmail

ProjectSend can route outgoing email through your Microsoft 365 or Gmail account using OAuth, available since ProjectSend 2.0. You register a small application in Microsoft Entra ID or Google Cloud, authorize it once from Settings, and ProjectSend handles token refresh from then on. No SMTP password is stored. The full setup steps and screenshots are in the email OAuth guide.

This note is based on ProjectSend 2.8.0 (October 2026). It is part of the Installation guides.

What you need

Both providers require registering an application and supplying the redirect URI for your installation. Have the full URL of your ProjectSend install on hand before you begin. If your installation is not set up yet, see Running ProjectSend with Docker first.

• Microsoft 365: an Azure account with permission to register apps in Entra ID (the free tier is sufficient) and a Microsoft 365 mailbox in the same tenant
• Gmail: a Google account or Google Workspace account with access to Google Cloud Console to create an OAuth application
• Both: the full URL of your ProjectSend installation and ProjectSend 2.0 or later

Set up Microsoft 365

Register an application in Microsoft Entra ID, grant it the Mail.Send permission, create a client secret, and connect from ProjectSend’s email settings. The full walkthrough is in the email OAuth guide at /docs/email-oauth.

In Entra ID, go to App registrations → New registration. Under Redirect URIs, add the following URI with your actual domain:

https://your-install.example.com/system/settings/email/oauth/callback

Under API permissions, add Microsoft Graph → Mail.Send. Remove any other permissions added automatically. Under Certificates & secrets, create a client secret and copy the value — it is shown only once.

In ProjectSend, go to Settings → Email → Outgoing email and choose Microsoft 365 (OAuth). Enter the Application (client) ID and the client secret, then follow the authorization prompt. If your organization requires tenant-level admin consent, the authorization step will include a prompt for an administrator to grant it.

Set up Gmail

Enable the Gmail API in a Google Cloud project, create OAuth 2.0 credentials with the redirect URI, and authorize from ProjectSend’s email settings. The full steps and screenshots are in the email OAuth guide at /docs/email-oauth.

In Google Cloud Console, create or select a project and enable the Gmail API. Configure the OAuth consent screen and set the user type: Internal for Google Workspace accounts, External for personal Google accounts.

Create OAuth 2.0 credentials (type: Web application) and add the redirect URI:

https://your-install.example.com/system/settings/email/oauth/callback

In ProjectSend, go to Settings → Email → Outgoing email, choose Google / Gmail (OAuth), enter the client ID and secret, and authorize.

One thing to watch for: if you set the user type to External and leave the consent screen in Testing status, OAuth tokens expire after seven days. The fix is to change the user type to Internal (Google Workspace) or to publish the OAuth consent screen, which removes the expiry.

Common issues

Most OAuth email failures come down to a redirect URI mismatch, an unverified Gmail consent screen, or a port setting from an older installation.

• Redirect URI mismatch. The URI registered in Entra ID or Google Cloud must match exactly what ProjectSend shows in Settings — scheme, domain, and path. A single character difference causes the authorization to fail.
• Mail.Send not consented (Microsoft 365). After creating the app registration, the Mail.Send permission still needs to be explicitly granted. In Entra, click Grant admin consent or allow the user to consent during the first authorization. Without this, ProjectSend gets a 403 from the Microsoft API.
• Port mismatch on installations before 2.7.1. The TLS and SSL encryption options used the wrong default ports in 2.7.0 — TLS uses port 587 and SSL uses port 465. This was fixed in the 2.7.1 release. Upgrade before configuring mail if you are on 2.7.0.

What OAuth email does not handle

OAuth email in ProjectSend covers outgoing notifications only — password resets, file share alerts, and system messages. ProjectSend does not receive email. File encryption at rest is a separate feature not yet available in 2.x.

The email OAuth guide has the complete steps and screenshots for both providers. For questions and edge cases, the community is on Discord. If you find something missing or wrong in the guide, the documentation lives in the ProjectSend repository — a PR or an issue helps the whole community.