Enterprise Email Configuration
Enterprise email configuration presets mailbox domains and IMAP / SMTP servers for the current workspace. Members can use the preset when connecting matching addresses, while authenticating their own mailbox accounts individually.
Open the administrative Integration → Apps → Email page, then Enterprise email → Mailbox configuration. For everyday email operations, see Using Email.
Before You Configure
- Your account needs management access to the Email app's administrative pages, configured in System Management → Role Management → Feature permissions
- Obtain mailbox domains, incoming and outgoing servers, ports, and encryption requirements from your email provider
- Servers must be reachable from the tenant Runtime deployment. SSL / TLS and STARTTLS are supported; unencrypted connections are not
- The configuration belongs to the current workspace and stores connection presets, rather than a central password for all members
- Gmail / Outlook OAuth applications are configured separately by the platform administrator; see Platform Mailbox Authorization below
Set Domains And Servers
- Select the edit button beside Enterprise email → Mailbox configuration to open Edit mailbox configuration
- Enter the Enterprise email name and set the Status to Enabled
- Under Email domains, enter the full domain after
@and press Enter to add it. You can add up to 20 domains - Configure the incoming server (IMAP) and outgoing server (SMTP)
- Select Save, then check the status, domains, and server details on the configuration page
| Setting | Value |
|---|---|
| Enterprise email name | Name identifying this configuration in the workspace |
| Status | Whether the connection preset is enabled |
| Email domains | Domains without @, mailbox user names, or URL paths. Matching is exact; subdomains are not included automatically |
| Incoming server (IMAP) | Provider's server domain, port, and encryption method |
| Outgoing server (SMTP) | Provider's server domain, port, and encryption method |
| Username | Each member's full email address when connecting |
New configurations default to IMAP 993, SMTP 465, and SSL / TLS. Follow your provider's requirements. When selecting STARTTLS, also enter the corresponding port.
Saving a configuration neither connects accounts for members nor sends a test email. Connections are verified when a member adds or updates a mailbox. Built-in providers use their standard settings; enterprise presets apply to matching configured domains identified as Other email.
Change Or Disable A Preset
Reopen the editor to change the name, domains, or servers, or set the status to Disabled and save.
- Changing a server preset does not rewrite existing mailbox connections. Members must check and update those accounts in Mailbox settings
- Disabling stops automatic application of the preset. It does not remove connected accounts or delete messages at the provider
- Configured domains also identify enterprise mailboxes for operation permissions and sharing. Disabling the preset does not remove those restrictions; review role settings and sharing rules before changing domains
Have Members Connect Their Mailboxes
- Confirm that members can see the Email app in their workspace
- A member opens Email → Add mailbox, enters their full enterprise email address, and selects Continue
- Matching addresses receive the preset server settings; the member supplies their own password, authorization code, or app-specific password
- Select Verify and save. Synchronization starts after incoming and outgoing authentication pass
If the provider requires an authorization code, the member must enable IMAP / SMTP and generate the code there first. Saving an administrator preset does not replace this step.
Review User Bindings
Open Enterprise email → User bindings to review active workspace members and their connections for the configured enterprise domains.
| Column | Meaning |
|---|---|
| Bound at | When the current mailbox connection was created |
| User | The member who connected the mailbox; members without a matching connection appear as unbound |
| Enterprise email address | Connected address matching the configured domains |
| Authentication | Password / authorization code or OAuth |
| Last synchronized at | Most recent synchronization time for this connection |
| Status | Bound or unbound |
Search by user or email address, filter by binding date range and status, or refresh the list. Export produces an Excel file containing all results within the current filters, rather than only the current page.
This shows current binding status, not a history of disconnections. It does not display members' mailbox passwords, authorization codes, or message bodies.
Configure Front-End Operation Permissions
Administrative access and member usage are separate: Feature permissions control backend configuration, while Resource permissions control individual front-end actions.
- Open System Management → Role Management and select a role
- Select Enterprise email under Resource permissions
- Allow or deny actions using the button names shown, save, and confirm that the role is assigned to the relevant users, departments, or organizations
| Action group | Permissions |
|---|---|
| Compose and reply | New email, reply, reply all, forward |
| Draft and send | Save draft, send |
| Scheduled delivery | Schedule send, change send time, cancel scheduled send |
| Organization | Archive / unarchive, mark read / unread, mark / unmark important, junk / not junk |
| Delete and restore | Delete / delete permanently, restore to inbox |
| Record associations | Link records, unlink records |
| Files and output | Preview and download attachments, print email |
Actions that toggle the same button share a permission, such as Mark / unmark important. Delete / delete permanently also share one permission. These permissions apply to enterprise mailboxes matching the configured domains.
Configure translation separately under Resource permissions → Translation, with individual controls for model translation, Google Translate, DeepL, Baidu Translate, and Youdao Translate. Check app visibility separately: allowing an email action neither displays the app automatically nor shares another person's mailbox.
Configure Read-Only Enterprise Mailbox Sharing
To let other members read selected enterprise mailboxes, add a rule under Role Management → Conditional sharing.
- Select New and enter a rule name in New condition rule
- Set the Share object type to Enterprise email; no shared form selection is needed
- Under Share with, choose recipient users, departments, organizations, or roles, or use variables
- Configure conditions using fields grouped under Mailbox owner, Mailbox owner's department, and Mailbox owner's organization
- Set an expiry if needed, confirm the resulting permission is Read-only, and save
- Sign in as a target member and check that the mailbox appears with a Shared label
Conditions and variables read the mailbox owner's profile and the profiles of their department and organization. They do not read the viewer's profile or linked business-record data. Variable source fields must contain valid values, and the rule must be within its effective period.
Sharing grants reading only, without sending on behalf of the owner, replying, modifying, or deleting. Attachment previews and downloads, and printing, remain subject to their resource permissions. Linked emails on record view pages follow the same mailbox access rules.
Platform Mailbox Authorization
The Soln platform administrator configures this in the control plane, separately from enterprise server presets. Members connecting Gmail / Outlook only complete the official authorization flow.
- Open Mailbox authorization in the platform console (
/platform/mail-oauth-applications) - Find Google / Gmail or Microsoft / Outlook and select Edit
- Copy the displayed Redirect URI exactly into the provider application's Web callback settings
- Enter the provider's Application Client ID and Client secret, enable the application, and save
- Return to the tenant's Email app and verify connection, authorization, and sending and receiving with a real mailbox
| Provider | Application preparation |
|---|---|
| Google / Gmail | Configure the OAuth consent screen in Google Cloud and create a Web application OAuth client. Mailbox access uses the https://mail.google.com/ scope. Add test users in testing mode and meet Google's verification requirements for public use |
| Microsoft / Outlook | Register a Web application in Microsoft Entra supporting the required organizational and personal accounts. Add Exchange Online delegated permissions IMAP.AccessAsUser.All and SMTP.Send, and allow offline access. Complete administrator consent where required; the mailbox must permit IMAP and SMTP AUTH |
For Microsoft, enter the client secret's value, rather than its ID. Leaving the secret blank while editing retains it. Changing the Client ID requires its corresponding new secret and reauthorization of connected accounts.
The callback must be accessible over HTTPS from users' browsers. Use the actual address shown on the page. Mailbox authorization is separate from identity-provider configuration for sign-in. Disabling platform mailbox authorization blocks new authorizations and token refreshes and can affect connected accounts later.
Official references: Google IMAP OAuth, Microsoft IMAP / SMTP OAuth.
Verify And Troubleshoot
| Symptom | What to check |
|---|---|
| Cannot open enterprise configuration | The current role needs management access to the Email app's administrative pages |
| No preset is applied to a member's address | Check whether the preset is enabled, the domain matches exactly, and the address is a known provider using built-in settings |
| Existing connections still use old servers | Presets do not rewrite connected accounts; members must update their mailbox settings |
| A member appears as unbound | Check that they finished connecting and that the mailbox domain is still in the current configuration |
| Connected account fails to synchronize | Check the front-end connection error, credentials, provider IMAP / SMTP settings, and network and DNS at the Runtime deployment |
| Actions are allowed but another person's mailbox is absent | Operation permissions do not grant data access; configure an effective enterprise mailbox conditional sharing rule |
| A shared mailbox is absent | Check app visibility, mailbox domain, owner status, rule conditions, sharing targets, and expiry |
| Provider authorization succeeds but connection fails | Authorization, IMAP / SMTP availability, and Runtime network access are all required; saving a Client ID and secret does not verify delivery |