A Graph mail connector combines Microsoft identity, least-privilege permissions, Outlook resource modeling, per-folder delta, change-notification renewal, sending, and tenant-aware recovery.
Use delegated permissions for a user-driven mailbox connection. Offer application permissions only for an explicit organizational use case with administrator consent, narrower internal authorization, and clear target-mailbox controls.
Support list, get, draft, send, reply, move, and delete according to the promised capability matrix. Retain Graph IDs, folder IDs, conversation IDs, Internet Message-ID, change keys, categories, and attachment types.
Follow @odata.nextLink through a round and store @odata.deltaLink only after applying the folder changes. Use notification subscriptions to reduce delay, renew them before expiration, and run periodic delta reconciliation.
Conditional Access, administrator policy, consent removal, shared-mailbox rights, and throttling can differ by tenant. Return actionable normalized errors with Graph diagnostic context and a reconnect or admin-consent path when appropriate.
No. Graph permissions are capability-specific. Request the documented permissions for each operation and avoid assuming read/write mailbox access automatically grants every send scenario.
Generally no. App-only Graph access is an organizational trust decision and requires the applicable administrator consent and internal access controls.
Not yet. Gmail, Microsoft Graph, and IMAP/SMTP connectors are planned. This guide documents the intended architecture and the provider requirements a production release must satisfy.
DewEngine is in development. Real use cases decide what ships first.