01
Missivus for Matomo
Available now
Password resets, scheduled reports, alerts — everything Matomo sends goes through Graph. Large report PDFs take the chunked-upload path automatically. Ships switched off; activates with four values.
№ 1 — Free · GPLv3 · Solvetus Labs
Your self-hosted apps are about to lose SMTP to Microsoft 365. Missivus fixes that.
Microsoft is retiring basic-auth SMTP — unchanged until December 2026, then disabled by default, with final removal to follow. When your tenant flips, password resets, scheduled reports and alerts from Matomo silently stop. Missivus sends them through Microsoft Graph instead — with application permissions and a free shared mailbox. No user signs in, nothing expires with a person, nothing is licensed.
01Missivus for MatomoAvailable now
02Missivus for WordPressAvailable now
03Missivus for Workers & NodePlanned
Why your Matomo mail stopped
[object Object]
The usual workarounds are worse than the problem. A licensed user account whose password becomes a shared server credential. A delegated OAuth flow that sends mail as a person and breaks the day they leave. Or a third-party SMTP relay that your privacy policy now has to explain.
Missivus takes the route Microsoft actually recommends for server software — Graph with application permissions — and pairs it with the one Exchange feature that makes it safe — an application access policy locked to a single free shared mailbox.
How it works
Three steps in your Microsoft tenant, once. About thirty minutes, every click documented.
Register an Entra app
Create an app registration with the Mail.Send application permission and a client secret. It is an identity for your server — not a user, no password anyone types, nothing to click through.
Lock it to one mailbox
One PowerShell line creates an application access policy that scopes the app to a single shared mailbox — noreply@yourcompany.com. The mailbox is free; nobody signs into it. Without the policy the app could send as anyone; with it, it can send as exactly one address.
Paste four values
Tenant ID, client ID, secret, sender address — into the plugin's settings page. Press "Send test email". Done. Rotation later is paste-one-value boring.
Table 1 — three ways to send
Application permission, delegated login, or SMTP?
The three ways self-hosted software can send through Microsoft 365 today, honestly compared.
| Missivus — application permission | Delegated OAuth (sign in as a user) | SMTP AUTH | |
|---|---|---|---|
| Works after the SMTP AUTH retirement (December 2026) | Yes — Graph is the supported path | Yes | Disabled by default from end of 2026, then removed |
| Needs a licensed user account | No — free shared mailbox | Yes, a real person's account | Yes, with a password |
| Survives a person leaving the company | Yes — no user involved | No — breaks with their account | No — password resets kill it |
| Mail comes from | Your company's no-reply address | A person's mailbox | A person's mailbox |
| Blast radius if the credential leaks | One shared mailbox, enforced by Exchange | Everything that user can do | The whole mailbox, interactive sign-in included |
| Cost | Free — GPLv3 plugin, no licence | Often a paid extension | A licence for the sending account |
The blast-radius line is the important one. Mail.Send as an application permission is tenant-wide by default — the application access policy in our setup guide is what narrows it to one mailbox, and we treat it as a required step, not optional hardening.
The Missivus family
02
Missivus for WordPress
Available now
Everything wp_mail() produces goes out through Graph — password resets, order confirmations, form notifications. Where the usual Microsoft 365 option is a paid extension that sends as a person, Missivus sends as your no-reply address, free.
03
Missivus for Workers & Node
Planned
A small JS/TS library for sending through Graph from Cloudflare Workers and Node services — the same transport this very site's contact form uses.
Rather have it done for you?
The software is free and stays free. Solvetus — the studio behind Missivus — installs and supports it commercially — Entra app, access policy, shared mailbox, plugin, a test email in your inbox and a handover document, done in one appointment.
Common questions
Does the shared mailbox need a Microsoft 365 licence?
No. A shared mailbox is free up to 50 GB, and Missivus authenticates as an application, not as the mailbox — nobody signs in as it and nothing is paid for it.
Is the application access policy really necessary?
Yes — without it, Mail.Send as an application permission lets the app send as anyone in your tenant. The policy narrows it to one mailbox. Our guide treats it as part of the installation.
Why not just use SMTP? Matomo supports it.
Microsoft is retiring basic-auth SMTP for Microsoft 365 — disabled by default from the end of December 2026, with final removal to be announced — and Matomo's PHPMailer path does not speak the OAuth variant that remains. Matomo's own FAQ treats the Microsoft 365 SMTP route as unsupported.
Stop losing password resets and reports
Set it up yourself with the interactive guide — every command pre-filled with your values — or have Solvetus do it in one appointment.