Frequently asked questions

No. An Exchange Online shared mailbox is free up to 50 GB and needs no licence assigned to it — which is the point. Missivus authenticates as an application, not as the mailbox, so nobody signs in as it and nothing is paid for it. A licence only becomes necessary if you convert it to a user mailbox, put it under litigation hold, or give it an archive.

Because Microsoft has retired basic-authentication SMTP for Microsoft 365. What remains is SMTP AUTH with OAuth2, which Matomo's mail path does not speak, or a legacy flow that Microsoft disables tenant-wide and that turns a licensed user's password into a shared server credential. Matomo's own FAQ now treats the Microsoft 365 SMTP path as unsupported. Graph with application permissions has none of those problems — no password, no user, no licence, and a credential scoped by Exchange to one mailbox.

Start with a client secret — two clicks in Entra, nothing on the filesystem, and the route the guide documents. A certificate is stronger, because the credential never travels in a request body, and worth it if your security policy asks for it. Both are fully implemented; you can switch at any time from the settings page.

Create the new secret in Entra — the old one keeps working until expiry, so there is no outage window. Copy the new Value (not the Secret ID), paste it into Missivus's settings, save, press "Send test email", then delete the old secret. Missivus caches the access token for at most 55 minutes, never the secret, so nothing needs restarting.

They send. Graph limits inline attachments to 3 MB, so above that Missivus automatically switches to Graph's chunked upload path — create a draft, upload in chunks, send. The decision is per message and size-aware. There is no setting for this, deliberately — scheduled-report PDFs must never fail on size.

Only for that large-attachment path — creating a draft and opening an upload session are not covered by Mail.Send. If you never send attachments over 3 MB, Mail.Send alone is enough; if one day you do, the failure is loud and names the missing permission. Both permissions are bounded by the same access policy, so Mail.ReadWrite grants nothing outside the one shared mailbox.

Yes — treat it as part of the installation, not optional hardening. Without it, Mail.Send as an application permission lets the app send as any mailbox in your tenant. The policy narrows it to one. The guide includes the verification commands, and asks you not to continue until the second test comes back Denied.

The test sends with the settings that are saved, not with what is typed on screen. Fill in the fields, tick "Send email through Microsoft Graph", and click Save — the button enables itself a moment later, and the note underneath names whatever is still missing.

Yes, with one temporary setting change — enable_plugin_upload. It ships off because it lets any superuser upload PHP that Matomo executes, so the guide walks you through switching it on, uploading, activating, and — importantly — switching it straight back off.

No. It ships switched off — activating the plugin changes nothing until you tick "Send email through Microsoft Graph". Deactivating restores Matomo's stock transport with nothing to clean up. The optional fallback to Matomo's own mail settings is also off by default — a failure you can see beats an email that quietly goes nowhere.

The usual suspects — AADSTS7000215 means the secret is wrong, almost always because the Secret ID was copied instead of the Value. AADSTS900023 is a wrong tenant ID. ErrorAccessDenied means the access policy doesn't cover the mailbox or admin consent was never granted. The full table, with fixes, is in the installation guide's troubleshooting section — and secrets are redacted before anything is logged, so the errors are safe to paste into an issue.

Anything that sends through Piwik\Mail goes through Missivus — password resets, scheduled reports, alerts, and third-party plugins that use Matomo's mail layer properly. A plugin that opens its own SMTP connection is untouched. A sibling WordPress plugin with the same transport is in development.