Available now
Missivus for Matomo
Password resets, scheduled reports, alerts — everything Matomo sends goes through Graph. Large report PDFs take the chunked-upload path automatically. Ships switched off; activates with four values.
Your self-hosted apps can't email through Microsoft 365 anymore. Missivus fixes that.
Microsoft retired basic-auth SMTP. Password resets, scheduled reports and alerts from Matomo silently stop. Missivus sends them through Microsoft Graph instead — with application permissions and a free shared mailbox. No user signs in, nothing expires with a person, nothing is licensed.
Why your Matomo mail stopped
Microsoft has switched off basic-authentication SMTP for Microsoft 365 tenants. Matomo's own FAQ now treats the Microsoft 365 SMTP path as unsupported. The failure is silent — no bounce, no error on screen — until someone notices the weekly report never arrived or a password reset never came.
The usual workarounds are worse than the problem. A licensed user account whose password becomes a shared server credential. A delegated OAuth flow that sends mail as a person and breaks the day they leave. Or a third-party SMTP relay that your privacy policy now has to explain.
Missivus takes the route Microsoft actually recommends for server software — Graph with application permissions — and pairs it with the one Exchange feature that makes it safe — an application access policy locked to a single free shared mailbox.
How it works
Three steps in your Microsoft tenant, once. About thirty minutes, every click documented.
Register an Entra app
Create an app registration with the Mail.Send application permission and a client secret. It is an identity for your server — not a user, no password anyone types, nothing to click through.
Lock it to one mailbox
One PowerShell line creates an application access policy that scopes the app to a single shared mailbox — noreply@yourcompany.com. The mailbox is free; nobody signs into it. Without the policy the app could send as anyone; with it, it can send as exactly one address.
Paste four values
Tenant ID, client ID, secret, sender address — into the plugin's settings page. Press "Send test email". Done. Rotation later is paste-one-value boring.
Application permission, delegated login, or SMTP?
The three ways self-hosted software can send through Microsoft 365 today, honestly compared.
| Missivus — application permission | Delegated OAuth (sign in as a user) | SMTP AUTH | |
|---|---|---|---|
| Works after Microsoft's basic-auth retirement | Yes — Graph is the supported path | Yes | Being switched off tenant-wide |
| Needs a licensed user account | No — free shared mailbox | Yes, a real person's account | Yes, with a password |
| Survives a person leaving the company | Yes — no user involved | No — breaks with their account | No — password resets kill it |
| Mail comes from | Your company's no-reply address | A person's mailbox | A person's mailbox |
| Blast radius if the credential leaks | One shared mailbox, enforced by Exchange | Everything that user can do | The whole mailbox, interactive sign-in included |
| Cost | Free — GPLv3 plugin, no licence | Often a paid extension | A licence for the sending account |
The blast-radius line is the important one. Mail.Send as an application permission is tenant-wide by default — the application access policy in our setup guide is what narrows it to one mailbox, and we treat it as a required step, not optional hardening.
The Missivus family
In development
Missivus for WordPress
The same application-permission model for WordPress — where today's only Microsoft 365 option is a paid extension that sends as a person. Leave your address and we will tell you when it ships.
Planned
Missivus for Workers & Node
A small JS/TS library for sending through Graph from Cloudflare Workers and Node services — the same transport this very site's contact form uses.
Rather have it done for you?
The software is free and stays free. Solvetus — the studio behind Missivus — installs and supports it commercially — Entra app, access policy, shared mailbox, plugin, a test email in your inbox and a handover document, done in one appointment.
Common questions
Does the shared mailbox need a Microsoft 365 licence?
No. A shared mailbox is free up to 50 GB, and Missivus authenticates as an application, not as the mailbox — nobody signs in as it and nothing is paid for it.
Is the application access policy really necessary?
Yes — without it, Mail.Send as an application permission lets the app send as anyone in your tenant. The policy narrows it to one mailbox. Our guide treats it as part of the installation.
Why not just use SMTP? Matomo supports it.
Microsoft retired basic-auth SMTP for Microsoft 365, and Matomo's PHPMailer path does not speak the OAuth variant. Matomo's own FAQ treats the Microsoft 365 SMTP route as unsupported.
Stop losing password resets and reports
Set it up yourself with the interactive guide — every command pre-filled with your values — or have Solvetus do it in one appointment.