To connect Dex to Exchange Online mailboxes, grant the Entra app the relevant mail Graph application permissions and (recommended) scope it to specific mailboxes.
Steps
1In the Microsoft Entra admin center, open your app registration (or reuse the M365 Base app).
2Under API permissions → Add a permission → Microsoft Graph → Application permissions, add Mail.Read (and Mail.Send / Mail.ReadWrite if Dex must send or modify mail); add MailboxSettings.Read for settings.
3Click "Grant admin consent for <tenant>" and confirm the green checkmarks.
4Recommended: limit the app to specific mailboxes using RBAC for Applications in Exchange Online so it cannot touch every mailbox.
5Provide Dex the Tenant ID, Client ID, and Client secret.
Paste into Dex
The connection form in the Dex app store asks for these values:
Directory (tenant) ID
Application (client) ID
Client secret (Value)
Shown only once at creation.
Scoped mailbox(es)
Optional — the mailbox(es) Dex is allowed to access.
