Your setup, pre-filled
Type your values once and every command below rewrites itself — the app name, the access policy, the verification tests and the pre-flight email. Copy each block straight into PowerShell.
Everything stays in your browser. Nothing you type here is stored or sent anywhere — no cookies, no localStorage, no network requests. Values disappear on refresh and are cleared after 15 minutes without activity.
This page mirrors Part 5 of the full installation guide, which walks through the Entra portal clicks that come first.Full installation guide on GitHub
Your seven values
Values clear after
Cleared — Your values were removed after 15 minutes without activity. Type them again to continue.
The host your Matomo runs on. It derives the Entra app name and the secret description.
From your app registration's Overview page. An identifier, not a secret.
From the same Overview page.
The Value column, shown once when the secret is created — not the Secret ID. Used only in the pre-flight block below; it never appears in the summary.
The shared mailbox Matomo will send as.
Your tenant's built-in domain — pre-filled from the sender address; edit it if yours differs.
The account you use at admin.microsoft.com — often an admin@…onmicrosoft.com account, not your daily email.
Derived names
- Entra app name
missivus-matomo-analytics.example.com- Client secret description
missivus-matomo-analytics.example.com- Security group address
noreply-apps@yourcompany.onmicrosoft.com
1 — Install the module and sign in
A browser window opens; sign in with the admin account. Windows has PowerShell built in; on macOS run `brew install --cask powershell`, then `pwsh`.
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName {{admin}}2 — Create the group
Its only member is your shared mailbox. Note the PrimarySmtpAddress PowerShell prints — it is usually on the tenant's built-in domain, and it is exactly what the next command needs.
New-DistributionGroup -Name "NoReply Apps" -Alias noreply-apps -Type Security -Members "{{sender}}"3 — Lock the app to the group
One line. This is the step that turns "an app that could send as anyone" into "an app that can send as exactly one address".
New-ApplicationAccessPolicy -AppId "{{clientId}}" -PolicyScopeGroupId "{{group}}" -AccessRight RestrictAccess -Description "Missivus (Matomo) may only send as {{sender}}"4 — Verify — wait 5–10 minutes first
The first line must show AccessCheckResult Granted, the second must show Denied. The second line uses a placeholder — replace it with any other real mailbox in your tenant, your own address is fine. Do not go further until it says Denied.
Test-ApplicationAccessPolicy -Identity "{{sender}}" -AppId "{{clientId}}"
Test-ApplicationAccessPolicy -Identity "{{other}}" -AppId "{{clientId}}"5 — Pre-flight, send one real email from PowerShell
Optional but strongly recommended — it proves tenant, app, secret and policy end to end before Matomo is involved. If the first part prints 20 characters, authentication works. StatusCode 202 plus an email in your inbox means the Microsoft side is done. Replace the recipient placeholder with your own inbox.
$TenantId = "{{tenantId}}"
$ClientId = "{{clientId}}"
$Secret = "{{secret}}"
$tok = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" -Body @{ client_id=$ClientId; client_secret=$Secret; scope="https://graph.microsoft.com/.default"; grant_type="client_credentials" }
$tok.access_token.Substring(0,20)$body = '{"message":{"subject":"Missivus pre-flight","body":{"contentType":"Text","content":"Graph app-only send OK"},"toRecipients":[{"emailAddress":{"address":"{{other}}"}}]},"saveToSentItems":false}'
Invoke-WebRequest -Method Post -Uri "https://graph.microsoft.com/v1.0/users/{{sender}}/sendMail" -Headers @{ Authorization = "Bearer $($tok.access_token)" } -ContentType "application/json" -Body $body | Select-Object StatusCode6 — Clean up and sign out
The secret was typed into this window, so clear it, then close PowerShell.
Remove-Variable Secret,tok,body
Disconnect-ExchangeOnlineFor your password manager
Copy this block into the notes of a password-manager entry. It holds the identifiers you will want when rotating the secret — the secret itself is deliberately not in it.
{{summaryAppName}}: {{appName}}
{{summaryTenantId}}: {{tenantId}}
{{summaryClientId}}: {{clientId}}
{{summaryGroup}}: {{group}}
{{summarySender}}: {{sender}}
{{summaryExpiry}}Then finish in Matomo
Enter the tenant ID, client ID, secret and sender in Administration → System → General settings → Missivus, tick "Send email through Microsoft Graph", save, and press "Send test email".