Clio Operate can send outbound email through Microsoft Office 365. Sending email from Clio Operate lets the case and task history record what was sent to participants. Clio Operate also tracks the replies and associates them with expectations.

You configure outbound email in the Outbound Email global feature.

Before you start

You need the following before you begin:

• Administrator access to Clio Operate, so that you can open the admin console.
• Permission in Microsoft Entra to create an app registration. If your tenant allows self-service registration, any user can do this. If it does not, you need the Application Developer role.
• Permission in Microsoft Entra to grant admin consent for delegated Microsoft Graph permissions. Any of the Privileged Role Administrator, Cloud Application Administrator, AI Administrator or Application Administrator roles can do this.
• An Office 365 account to use as the system account. The account must have a mailbox.
• The mailbox that notification emails are sent from, if it is not the system account's own mailbox.

Set aside time to work in two places. You create an app registration in the Azure portal, then return to Clio Operate to configure the linked service.

Outbound email mechanisms

For Office 365, Clio Operate sends outbound email using the Microsoft Graph API. The table below lists all outbound email mechanisms and their current status.

How Clio Operate secures the connection to Office 365

The integration uses the industry standard OAuth 2.0 protocol, so Clio Operate never stores your Office 365 credentials. Instead, an administrator or an end user signs in to Microsoft, and Microsoft issues security tokens to Clio Operate. Think of these tokens as temporary passes that you can revoke at any time.

Clio Operate stores tokens in its database, encrypted with 256-bit AES.

Because each account is linked by an interactive sign-in to Microsoft, your existing identity controls still apply:

• Accounts can have MFA enabled. Whoever links the account completes the MFA challenge as part of the linking process.
• Accounts can have an expiring password. Clio Operate stores a refresh token rather than the password, so a user changing their own password does not break the integration. An administrator resetting the password from an admin centre is different, and does break it. See When a mailbox link expires.
• Conditional Access applies. Microsoft evaluates the sign-in against your policies in the same way as any other sign-in.
• No account needs an app password, and no account needs excluding from your security baselines.

Outbound email uses no client credentials grant and no application permissions.

Create the app registration

Follow Create an app registration for Clio Operate, using the values in the Outbound email row of the table in that article. In summary, outbound email needs:

• A redirect URI of type Web, set to https://[your-Clio-Operate-instance]/externalServices/replyFrom.
• A client secret.
• The offline_access, Mail.Send and Mail.Read delegated permissions, with admin consent.

Clio Operate requires all three permissions. Mail.Send sends the email, offline_access provides the refresh token, and Mail.Read supports the connection test described later in this article. Do not grant Mail.ReadWrite, because outbound email does not write to mailbox contents.

If you already use Office 365 to authenticate users in Clio Operate, you can reuse that app registration, but only by adding this redirect URI and these permissions to it. See Using one registration for more than one integration in that article.

You need three values from the registration: the Directory (tenant) ID, the Application (client) ID and the client secret.

Configure Clio Operate

Select the Graph API mechanism

1. Open the Modeller and navigate to Global features.
2. Under Channels, select the settings icon on the Outbound Email feature.
3. Set Exchange Mode to Exchange Graph API.
4. Select Save & Close.

The blade then confirms that outbound emails are sent using each user's linked account.

The Outbound Email blade also provides Configure it, Re-link it and Inspect it buttons once the mode is set. These are shortcuts to the linked service, so you can complete the next two sections from here rather than navigating to Manage Linked Services each time.

Set up the linked service

1. Sign in to Clio Operate as an administrator and open the admin console.
2. Navigate to Integrations > Manage Linked Services.
3. Select Configure on the card for the Office 365 - Outbound Email provider.
4. Under App configuration, enter the Tenant Id, App Id and Client secret that you gathered above.
5. Select Save and close on the ribbon.

The card displays Configuration valid. Until the configuration is valid, the service is unavailable.

The card title shows the value of the service Name field, which your administrator can change, so it may differ between deployments. The provider name, Office 365 - Outbound Email, appears below the title and does not change.

Link the system account

Clio Operate uses two kinds of linked accounts for outbound email. The system account is a single Office 365 account linked to the integration itself. Each end-user can also link their own mailbox.

Clio Operate uses the system account for notification emails and for anything else that the system sends as a background process. Clio Operate uses the end-user's own mailbox when that user sends an email.

The system account must have full control of the mailbox that Clio Operate uses for notifications. In Exchange Online, grant it the Read and manage permission on that mailbox. You configure the notification mailbox in the Notifications feature.

Clio Operate links the system account using the OAuth 2.0 authorisation code flow, against the app registration you created above. This is the same flow that an individual user follows to link their own mailbox.

1. Navigate to Integrations > Manage Linked Services.
2. Find the card for the Office 365 - Outbound Email provider.
3. Select Link.
4. Sign in to Microsoft as the system account.

Microsoft records the consent that you grant against the account that signs in, so sign in as the system account rather than as yourself. After linking, the card displays the linked account address, and Link changes to Unlink.

Test the connection

1. Select the account menu, then select My linked accounts.
2. Find the Office 365 - Outbound Email service.
3. Select Inspect.
4. Select Test connection.

The test provisions a client and reads the inbox, so a successful result confirms both the app registration and the linked account. The Inspect panel also displays the token state, the token expiry and the fallback account.

Send from team email addresses

Users can send email from their own mailbox or from a team email address. The teams a user belongs to in Clio Operate determine which team addresses are available to them, as well as the contact email addresses assigned to those teams.

Make the service available to teams

Before end-users can link their own mailboxes, you must make the service available to their teams.

1. Navigate to Integrations > Manage Linked Services.
2. Select Configure on the card for the Office 365 - Outbound Email provider.
3. Under Team availability, add the relevant teams.
4. If team members must link their own accounts, select Required for that team.

An end-user sees the service only if they belong to at least one of the teams listed here. If none of their teams is listed, the service does not appear in their linked accounts and they cannot link their mailbox.

Each end-user links their own mailbox from My linked accounts, and only that user can do it, because linking requires them to sign in to Microsoft as themselves.

Grant "send as" permissions

To send email from a team email address, the sending account must have "send as" permission on that mailbox in Exchange Online. This permission is different from "send on behalf of".

Which account needs the permission depends on who is sending:

• If an end-user sends from a team address using their own linked mailbox, that user's account needs the permission.
• If Clio Operate sends from a team address as the system account, for notification emails or when fallback to system tokens is enabled, the system account needs the permission.

To grant the permission:

1. Open https://admin.microsoft.com and find the mailbox under Users.
2. Select the Mail tab, then select Manage mailbox permissions.
3. Beside Send as, select Edit, then select Add permissions.
4. Search for the account that you are granting permission to, select its checkbox, then select Save.

Configure sent items behaviour

This step is optional. Clio recommends it, so that sent email appears where users expect to find it.

By default, when one account sends from another mailbox, the sent email is placed in the sending account's own Sent Items folder rather than in the mailbox it was sent from. For example, if the system account sends from team1@mytenant.com, the sent email appears in the system account's Sent Items rather than in team1's.

To place the sent email in the mailbox it was sent from, run the following command in Exchange Online PowerShell for each mailbox. You can run it locally or from Azure Cloud Shell.

Set-Mailbox [delegated-account] -MessageCopyForSentAsEnabled $true

How Clio Operate chooses an account to send with

Allow fallback to system tokens

The Office 365 - Outbound Email service has a setting that controls what happens when an end-user has not linked their own mailbox.

1. Navigate to Integrations > Manage Linked Services.
2. Select Configure on the card for the Office 365 - Outbound Email provider.
3. Under Token management, set Allow fallback to system tokens?.

When the setting is On, an end-user who has not linked their own mailbox can still send email. Clio Operate sends it using the system account's token, so the email appears to come from the system account's mailbox rather than from the end-user's.

When the setting is Off, an end-user who has not linked their own mailbox receives an error prompting them to link their account first.

Choose the setting according to whether per-user attribution or uninterrupted sending matters more in your deployment. If every outbound email must be attributable to the individual sender, set Allow fallback to system tokens? to Off.

When a mailbox link expires

A stored refresh token expires after 90 days of inactivity. Microsoft sets this period and it cannot be changed.

A link can also end sooner. An administrator resetting the account password from the Microsoft Entra admin center or the Microsoft 365 admin center removes the link, as does revoking the account's sign-in sessions. A user changing their own password does not. For the full list, see What invalidates the tokens.

Plan for this when you rotate the system account password. Resetting it from either admin centre stops outbound email until someone links the account again, so schedule the re-link at the same time.

When Clio Operate next needs a token and the refresh is refused, it removes the affected link. For an end-user, Clio Operate removes their own mailbox link. For the system account, it removes the system link. Clio Operate does not remove links on a schedule, so this happens the next time the account is used to send.

An end-user whose link has been removed sees an error with a My linked accounts button, which opens their linked accounts so that they can link again. Only that user can relink their own mailbox. An administrator relinks the system account from the Office 365 - Outbound Email card.

External email warning

To warn users when they are sending email to someone outside their organisation, configure the warning at the bottom of the Outbound Email blade.

Related articles

• O365 Integration: Overview
• Using O365 for Authentication
• SharePoint Online as DMS