Mail setup

Deem Insight sends mail for notifications, scheduled reports and system messages. You can send over classic SMTP or over Microsoft 365. You pick one in the configuration, and you can change it and test it without restarting the application.

Where the settings live

Open System administration → Configurations and choose Mail send settings. The dialog needs the configuration permission.

Everything is stored in a single setting, MAIL_CONFIG. If you leave it blank, Deem Insight falls back to the mail.properties file on the server.

Tip

Saving in the dialog takes effect immediately. The next mail uses the new settings — no restart, and this holds for both transports.

The dialog

The dialog has two halves that work together:

1. Fields for the transport and its settings. Only the fields for the selected transport are shown; switching transport hides the others but keeps what you typed.
2. Generated JavaMail config — an editable text version of the same settings.

Send test and Save both use the text, not the fields. So you can hand-tune a setting that has no field, test it, and save it as it stands. Note the other direction: changing a field regenerates the text and overwrites manual edits, so make your manual changes last.

The test mail is sent straight out. It is not stored in the mail queue.

Caution

Passwords and the client secret are masked in the input fields. The generated config text is a raw editor and shows the effective configuration — a password you type in plain text is echoed there. Stored secrets are already encrypted.

SMTP

The classic route. You need:

Setting	Notes
Host and port	Port 587 is normal for STARTTLS
Authentication	User name and password
Security	STARTTLS or TLS, and whether to check the server certificate
Sender address	The address mail is sent from

Microsoft 365

Microsoft is retiring basic authentication for SMTP in Exchange Online, so a Microsoft 365 tenant needs a modern route. Deem Insight sends through the Microsoft 365 mail service instead of talking SMTP.

The message itself is built exactly the same way — attachments, headers and formatting are unchanged. Only the delivery differs, so moving a customer over is a configuration change.

Set-up in Microsoft 365:

1. Register an application in Entra ID (Azure AD).
2. Grant it the application permission Mail.Send. This needs admin consent.
3. Note the tenant id, client id and client secret.
4. Restrict the application to the mailboxes it may send as, with an application access policy in Exchange Online. Without it, the permission allows sending as any mailbox in the tenant.

Then fill in tenant id, client id, client secret and the sender mailbox in the dialog. Deem Insight gets and refreshes access tokens on its own; nothing needs to be renewed manually.

Caution

Mail.Send is a broad permission. The application access policy is what narrows it down, and auditors will ask for it. Set it up at the same time as the app registration.

Size limit

A message including its attachments must stay under about 4 MB. Larger messages are rejected with a clear error rather than failing silently.

Checklist when mail does not arrive

Work down the list — most problems are on the network, not in Deem Insight:

• Can the application server resolve the mail host by name?
• Is outbound traffic to the port open in the firewall? For SMTP that is usually 587.
• Does the TLS handshake succeed, and is the certificate trusted?
• Are the credentials right, and is the authentication method the one the server expects?
• Send a test mail from the Mail send settings dialog.
• Still failing? Check the application log, and the status of the queued mail under Emails.

Two errors worth recognising:

• Basic authentication is not supported on the SMTP route means that Microsoft 365 tenant has to move to the Microsoft 365 transport.
• A failure right after saving Microsoft 365 settings is usually the application access policy or a missing admin consent, not the mail itself.

Related pages

• System administration
• Configuration settings