Per-account OAuth2 Microsoft Exchange customization

Exchange setup instructions

1. Add a new email account: Thunderbird app menu ☰ > Add Account > Email and enter a Microsoft 365 email address (e.g. nemo@o365.thunderbird.net) and then click MANUAL CONFIGURATION on the bottom left of the Account hub.
2. Click Microsoft Exchange or Microsoft 365 and then click Set up account.
3. In the Exchange settings dialog, type one of the following URLs into the Enter the service URL field:
   • For EWS: https://outlook.office365.com/EWS/Exchange.asmx
   • For Graph: https://graph.microsoft.com/
4. Click Find settings. For EWS, Exchange Web Services will automatically be selected. For Graph, Microsoft Graph will be selected.
5. Your Microsoft 365 email address (e.g. nemo@o365.thunderbird.net) you used in step 1 should be automatically entered into the Username field (if not, then correct it).
6. For Authentication Method, select OAuth2.
7. Click Advanced configuration above the Connect button.
8. In Server Settings, click the Advanced… button above and to the right of Message Storage.
9. Check the Override Office365 Settings box.
10. Enter the application ID your organization has set up in the Application ID field. Sometimes it will be called a Client ID.
11. Enter your organization's Microsoft 365 Tenant ID in the Tenant ID field.
12. Optionally enter the Redirect URI. Default value is: http://localhost.
13. Optionally enter the Endpoint Host. Default value is: https://login.microsoftonline.com
14. Optionally enter the OAuth scopes. Default values are:
    • For EWS: https://outlook.office.com/EWS.AccessAsUser.All offline_access
    • For Graph: https://graph.microsoft.com/User.Read https://graph.microsoft.com/MailboxFolder.ReadWrite https://graph.microsoft.com/Mail.ReadWrite https://graph.microsoft.com/Mail.Send https://graph.microsoft.com/offline_access
15. Click the OK button to close the Advanced Account Settings dialog.
16. Accept the Reauthorize Access dialog and trigger an email update. Messages should download and the account should operate as normal.

US Government Compute Cloud (GCC)

GCC does not include the common Thunderbird application ID, so all GCC users must have an organization that registers a Thunderbird application ID for their tenant IDs. When following the instructions above, use the Application ID and Tenant ID provided to you by your administrator and the following values for the other fields:

• Exchange URL:
  • For EWS: https://outlook.office365.us/EWS/Exchange.asmx
  • For Graph: https://graph.microsoft.us/
• Redirect URI: http://localhost
• Endpoint Host: https://login.microsoftonline.us

Per-account OAuth2 IMAP and POP3 customization

As of 156, Thunderbird supports per-account OAuth2 manual configuration for IMAP and POP3 accounts. Here’s how to customize OAuth for your IMAP (or POP3) account:

1. Create your IMAP (or POP3) account as normal on the first run or Thunderbird app menu ☰ > Add Account > Email.
2. Enter your full name and any valid non-Exchange email address and then click Continue.
3. Click EDIT CONFIGURATION on the bottom right (NOTE: Do not click Continue because it will trigger our autoconfig process to detect settings).
4. Click Advanced configuration on the bottom right.
5. In the Confirm Advanced Configuration dialog that pops up, click OK.
6. Click Advanced… in Server Settings (just above Message Storage).
7. In the Advanced Account Settings dialog that pops up, check ✓ Use custom OAuth2 settings.
8. Customize using the value for your custom OAuth provided by your mail provider or mail administrator and then OK to save the settings.(NOTE: If Use system web browser is checked, you must use http not https on localhost in the Redirect URI: field.)
9. Select Authentication Method OAuth2 (if not previously selected).