Mailbox Integration

Google accounts have settings that restrict access to third-party applications that use less secure sign-in technology. By their definition, this applies to connections that authenticate with a username and password, which are vulnerable to hijacking.

The setup requirements are based on the current setting for managing less secure apps. The requirements apply to the Google account that you use to authenticate with the Gmail service.

• If you're connecting with a Google account that you manage yourself, generate an application-specific password (App Password) in your Google account and use it for authentication. Leave the option to enable access for less secure apps in your Google account Off.

  App Passwords can only be used with accounts that have 2-Step Verification turned on.

• If you use a Google account that is managed by your organization as part of Google Workspace, make sure that the option to Disable access to less secure apps is switched on.

  The Google account that you store in the mailbox integration settings must have 2-Step Verification enabled. To connect to the Gmail service with this account, generate an application-specific password in your Google account.

  • For the Username, enter the username for your Google account.

  • For the Password, enter an application-specific password that you generated in Google.

While you may still allow access to less secure apps, Google has indicated that it will eventually discontinue support for this type of authentication. We strongly encourage you to enable 2-Step Verification and use an App Password to authenticate with the Gmail service.

Use the following instructions to configure a connection with a generic mail service.

An integration with Microsoft Exchange Online (also commonly known as Exchange Online, Office 365, or Microsoft 365) requires that you perform the following actions:

• First, you need to register an application in the Microsoft Azure portal. This gives you access to a client ID and client secret that you will use to re-connect to the Exchange Online service. For more information, see Register a Client Application in Microsoft Azure.

• Add the requisite API permissions to the client app. For details, see Add the Required Permissions to the Client App.

• Configure the configuration for the Mailbox integration in YouTrack to use the settings for integrations with Microsoft Exchange Online. For instructions, see Update the Mailbox Integration Settings in YouTrack.

Register a Client Application in Microsoft Azure

This setup requires that you meet the following prerequisites:

• A valid license for Microsoft Exchange Online.

• Administrative access to Microsoft Azure Active Directory (AD).

To complete the migration, you will need to obtain the following information from the Microsoft platform:

• The email address of the mailbox where you want to retrieve incoming messages. This mailbox must belong to the same Azure AD service where you register the app.

• The Application (client) ID of the app that is registered in the Microsoft Azure portal.

• The Directory (tenant) tenant ID of your Azure Active Directory tenant organization.

• A client secret that you created for the registered app.

The Application (client) ID and Directory (tenant) ID can be found in the Essentials section of the client application as shown below.

The client secret can be generated from the Certificates & secrets < Client secrets section.

To learn how to perform this setup, please follow the instructions in the product documentation for Microsoft Azure.

Add the Required Permissions to the Client App

Next, you need to add the following API permissions to the app:

• Mail.ReadWrite must be granted as an Application permission.

• User.Read must be granted as a Delegated permission.

The list of permissions can be found in the API permissions settings of the client app.

If you are logged in under an administrator account (as listed in the prerequisites), you can grant the application permission Mail.ReadWrite yourself. If not, you will need to ask an administrator to grant admin consent to the permissions configured for the application.

To learn how to configure permissions for a client app, please follow the instructions in the product documentation for Microsoft Azure.

The mailbox integration in YouTrack only supports POP/POPS and IMAP/IMAPS. The default protocol for Microsoft Exchange, MAPI, is not supported. If you want to connect to a Microsoft Exchange, you have two options:

• Enable and configure either POP or IMAP in the Microsoft Exchange, then configure the authenticated SMTP settings. With these mail connectors enabled, you can follow the instructions below and establish a connection.

  Pay attention to the special instructions for Microsoft Exchange mailboxes.

• Establish a connection through an intermediate gateway server. This lets you connect to the Exchange Server with POP/IMAP and SMTP disabled. The DavMail exchange gateway, for example, converts proprietary Exchange formats into email protocols that YouTrack understands. For setup instructions, refer to the DavMail Gateway documentation.

  With this setup, follow the instructions below to establish a connection to the gateway server.

For Microsoft Exchange Server, the mailbox integration supports connections to shared mailboxes. You can use the username and password of any user who is a member of the shared mailbox to authenticate.