Skip to main content
Porcia uses app-only authentication via Microsoft Graph to scan your org’s mailboxes server-side. No per-user setup, no forwarding rules — just complete vendor discovery across the entire organization.

​
Prerequisites

  • Microsoft 365 Global Administrator account
  • Access to the Azure portal (portal.azure.com)
  • 10–15 minutes for setup
This connects email scanning only. To also discover SSO-accessed apps and sync your directory, set up the SSO & Directory integration separately — it uses the same Azure app registration.

​
How it works

Porcia registers an Azure AD application with app-only Mail.Read permission, which allows it to query mailboxes across the tenant via Microsoft Graph. Admin consent is required. Email content is processed in memory and immediately discarded; only extracted metadata (vendor, pricing, dates) is retained.

​
Step-by-step setup

1

Go to Settings → Integrations → Email

In your Porcia workspace, navigate to Settings → Integrations → Email and click Connect Microsoft 365.
2

Register an app in Azure

Go to portal.azure.com → Azure Active Directory → App registrations → New registration.
  • Name: Porcia Integration (or any name you prefer)
  • Supported account types: Accounts in this organizational directory only
  • Click Register
Note the Application (client) ID and Directory (tenant) ID — you’ll need both.
3

Create a client secret

In your app registration, go to Certificates & secrets → Client secrets → New client secret.
  • Set a description (e.g. “Porcia”)
  • Choose an expiry (24 months recommended)
  • Click Add and immediately copy the Value — it’s only shown once
4

Grant API permissions

Go to API permissions → Add a permission → Microsoft Graph → Application permissions.Add the following permission:
  • Mail.Read — Read mail in all mailboxes
Click Add permissions, then click Grant admin consent for [your org] and confirm.
5

Enter credentials in Porcia

Back in Porcia (Settings → Integrations → Email), enter:
  • Tenant ID
  • Client ID
  • Client Secret
Click Connect. Porcia validates the credentials and begins the initial scan immediately.

​
What gets scanned

  • All mailboxes in your Microsoft 365 tenant
  • Emails matching vendor communication patterns (invoices, renewals, signups, OAuth notifications)
  • Personal and non-vendor email is ignored entirely

​
Permissions

Porcia cannot send email, delete messages, or access Teams, SharePoint, OneDrive, Calendar, or any other Microsoft 365 service.

​
Troubleshooting

Admin consent is likely missing. Go to Azure → App registrations → [your app] → API permissions and click Grant admin consent for [your org]. Only a Global Administrator can grant tenant-wide consent.
Client secrets are only shown once at creation. If you lost it, go to Certificates & secrets, delete the old secret, create a new one, and update the value in Porcia.
  • Wait 10–15 minutes — the initial scan takes time for large tenants
  • Confirm vendor emails exist in employee inboxes
  • Verify Mail.Read (Application) permission is granted — not Delegated
  • Check that admin consent was granted (green checkmark in the permissions list)
Azure client secrets have a maximum lifetime of 24 months. When one expires, go to Certificates & secrets, create a new secret, and update the value in Porcia Settings.

​
Disconnecting

  1. Go to Settings → Integrations → Email
  2. Click Disconnect next to Microsoft 365
  3. Confirm
To fully revoke access, also delete the client secret or the entire app registration in Azure.

​
Next steps

Connect SSO & Directory

Discover SSO apps and sync your directory

Install Browser Extension

Track real usage across the org

Troubleshooting

Fix email sync issues