Add an exchange mailbox in Mail app

ℹ️ Support
, ,
1

Hello everyone,

I’m trying to add Exchange accounts to my Nextcloud. I followed the documentation guide to configure an Entra ID app. If I add an account that is a domain admin, the account is successfully created in Mail and works.

When I try with a regular user account, the OAuth2 window shows an approval request. That’s normal—based on what I’ve read, there are no (API) permissions available for IMAP for standard users.

So I approve the request in Entra ID using an admin account. After that, when I try to add the account again, the OAuth2 window asks for approval again. And again, and again… it loops.

If anyone has any ideas, I’m interested.

Thanks.

2

Did you try it yet in incognito mode? It’s also good to double check your Nextcloud server log if it’s not producing errors in the background.

3

Yes already tested incognito mode without success

I got warning in entra Id access logs saying approbation is required each time I try to connect to the mailbox from NextclouD

4

I have exactly the same issue. Hope we will find a solution!

5

I checked nextcloud log.

1 DNS error :
{“reqId”:“fjf7olHcl9CYiJblFgz0”,“level”:2,“time”:“2026-02-07T19:23:58+00:00”,“remoteAddr”:“212.X.X.X”,“user”:“admin”,“app”:“PHP”,“method”:“GET”,“url”:“/apps/mail/api/autoconfig/ispdb/tld.fr/support%tld.fr”,“scriptName”:“/index.php”,“message”:“dns_get_record(): A temporary server error occurred. at /var/www/html/lib/private/Http/Client/DnsPinMiddleware.php#99”,“userAgent”:“Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36”,“version”:“32.0.5.0”,“data”:{“app”:“PHP”}}

2 - Invalid microsoft_oauth_client_id…. :
{“reqId”:“CpnwM3eNtVkzvwhIWxeC”,“level”:2,“time”:“2026-02-07T19:24:26+00:00”,“remoteAddr”:“x.x.x.x”,“user”:“admin”,“app”:“no app in context”,“method”:“GET”,“url”:“/settings/admin/groupware”,“scriptName”:“/index.php”,“message”:“Invalid microsoft_oauth_client_id data provided to provideInitialState by mail”,“userAgent”:“Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36”,“version”:“32.0.5.0”,“data”:}

3 - ERROR : decrypt() … null given :
{“reqId”:“38iqUVUuNA4v0ff6o7mi”,“level”:3,“time”:“2026-02-07T19:40:02+00:00”,“remoteAddr”:“x.x.x.x,“user”:“admin”,“app”:“mail”,“method”:“GET”,“url”:“/apps/mail/”,“scriptName”:“/index.php”,“message”:“Could not load account mailboxes: OC\Security\Crypto::decrypt(): Argument #1 ($authenticatedCiphertext) must be of type string, null given, called in /var/www/html/custom_apps/mail/lib/IMAP/IMAPClientFactory.php on line 104”,“userAgent”:“Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36”,“version”:“32.0.5.0”,“exception”:{“Exception”:“TypeError”,“Message”:“OC\Security\Crypto::decrypt(): Argument #1 ($authenticatedCiphertext) must be of type string, null given, called in /var/www/html/custom_apps/mail/lib/IMAP/IMAPClientFactory.php on line 104”,“Code”:0,“Trace”:[{“file”:“/var/www/html/custom_apps/mail/lib/IMAP/IMAPClientFactory.php”,“line”:104,“function”:“decrypt”,“class”:“OC\Security\Crypto”,“type”:“->”,“args”:[“*** sensitive parameters replaced “]},{“file”:”/var/www/html/custom_apps/mail/lib/IMAP/MailboxSync.php",“line”:88,“function”:“getClient”,“class”:“OCA\Mail\IMAP\IMAPClientFactory”,“type”:“->”,“args”:[" sensitive parameters replaced “]},{“file”:”/var/www/html/custom_apps/mail/lib/Service/MailManager.php",“line”:139,“function”:“sync”,“class”:“OCA\Mail\IMAP\MailboxSync”,“type”:“->”,“args”:[" sensitive parameters replaced “]},{“file”:”/var/www/html/custom_apps/mail/lib/Controller/PageController.php",“line”:162,“function”:“getMailboxes”,“class”:“OCA\Mail\Service\MailManager”,“type”:“->”,“args”:[" sensitive parameters replaced ***”]},{“file”:“/var/www/html/lib/private/AppFramework/Http/Dispatcher.php”,“line”:204,“function”:“index”,“class”:“OCA\Mail\Controller\PageController”,“type”:“->”,“args”:},{“file”:“/var/www/html/lib/private/AppFramework/Http/Dispatcher.php”,“line”:118,“function”:“executeController”,“class”:“OC\AppFramework\Http\Dispatcher”,“type”:“->”,“args”:[{“class”:“OCA\Mail\Controller\PageController”},“index”]},{“file”:“/var/www/html/lib/private/AppFramework/App.php”,“line”:153,“function”:“dispatch”,“class”:“OC\AppFramework\Http\Dispatcher”,“type”:“->”,“args”:[{“class”:“OCA\Mail\Controller\PageController”},“index”]},{“file”:“/var/www/html/lib/private/Route/Router.php”,“line”:321,“function”:“main”,“class”:“OC\AppFramework\App”,“type”:“::”,“args”:[“OCA\Mail\Controller\PageController”,“index”,{“class”:“OC\AppFramework\DependencyInjection\DIContainer”},{“_route”:“mail.page.index”}]},{“file”:“/var/www/html/lib/base.php”,“line”:1061,“function”:“match”,“class”:“OC\Route\Router”,“type”:“->”,“args”:[“/apps/mail/”]},{“file”:“/var/www/html/index.php”,“line”:25,“function”:“handleRequest”,“class”:“OC”,“type”:“::”,“args”:}],“File”:“/var/www/html/lib/private/Security/Crypto.php”,“Line”:92,“message”:“Could not load account mailboxes: OC\Security\Crypto::decrypt(): Argument #1 ($authenticatedCiphertext) must be of type string, null given, called in /var/www/html/custom_apps/mail/lib/IMAP/IMAPClientFactory.php on line 104”,“exception”:{},“CustomMessage”:“Could not load account mailboxes: OC\Security\Crypto::decrypt(): Argument #1 ($authenticatedCiphertext) must be of type string, null given, called in /var/www/html/custom_apps/mail/lib/IMAP/IMAPClientFactory.php on line 104”}}

About DNS error, it’s weird because I can make a ping to outlook.office.com or others domains without problem. So resolution works fine…

If someone has an idea ??..
Thanks

6

Which guide did you use to set this up?
Mail — Nextcloud latest Administration Manual latest documentation

I set this up myself last week, if you follow the exact steps it should work.

Things to verify:

  • Double check if you have setup the right callback URL to Nextcloud.
  • Copied right app ID
  • Tenant ID needs to be common in this case.
7

Yes this guide.

url ok
app id ok
tenant id set to “common” as in the tutorial

I successfully connected a mailbox only if I connect a user having tenant admin rights.

In other hand, I discovered this thread on github, opened since 2 years and still active :

It seems to be the same issue