Before you start
Ticks are kept in this browser only.
Follow the path that matches your account. Provider screenshots come from the linked official documentation and may show a different theme or older navigation. Configuration examples are labelled separately.
Permissions to choose
Use these exact permission names. Conditional permissions are needed only for the features described.
| Permission / scope | When needed | What it allows |
|---|---|---|
https://graph.microsoft.com/Mail.Read | Required | Delegated read access to messages and attachments in the signed-in user's mailbox.Choose Delegated permissions in Entra. Case targeting is enforced by Revient; this is not a grant limited to one message. |
https://graph.microsoft.com/User.Read | Required | Read the signed-in account identity so Revient can identify the connected mailbox. |
offline_access | Required | Allow refresh of the delegated connection after its current access token expires. |
Mail.Send / Mail.ReadWrite / application Mail.Read | Not requested | No sending, mailbox modification or app-only access to organisational mailboxes is needed. |
Staff review / AI assessment | Optional | Independent Revient permissions for specific retained messages. |
Use the delegated versions of the Graph permissions. Tenant policy may still require administrator approval. A Microsoft Entra identity without a supported mailbox cannot supply email evidence.
Connect your mailbox and add evidence
Start in Revient. The app registration, secret and callback are managed by the Revient operator, not by each customer.
Continue to Microsoft from Integrations
Revient → Integrations → Microsoft 365 / Outlook → Connect
- Open the connection drawer and click Continue to Microsoft.
- If the button is disabled with an operator-setup message, Revient's application must be configured first. No Entra client ID or secret is required from a merchant.
You should seeMicrosoft opens its account picker or sign-in page.Approve the correct mailbox and delegated permissions
Microsoft → account picker → permission request
- Sign in to the mailbox containing the case correspondence. Check the app identity and requested read/profile/continued-access permissions.
- Approve the request if you are authorised. If your organisation requires administrator approval, follow that policy before retrying.
- Wait for the return to Revient and check the displayed mailbox identity.
You should seeThe chosen mailbox appears as CONNECTED. The case search below verifies that email access works for that account.Open a case and check its email
Revient → Cases → selected case → Evidence
- Connecting a mailbox turns on automatic checks. Every active case is checked for messages that mention its order number and involve the customer. You do not search or pick messages yourself.
- Open a case and go to Evidence. Under Email you see each connected mailbox and when it was last checked. Click Recheck mailbox now to queue a fresh check for that case.
- If a check fails because access expired, the case shows the reason with a link to reconnect. Other failures retry automatically.
- Pause automatic checks under Integrations → Manage. Disconnecting stops future reads but keeps evidence already saved to cases.
You should seeMatching messages appear in the case's evidence list under Communication after the check finishes, with sender, date and the message text.Review the matched correspondence
Revient → case → Evidence → Communication
- Click a message in the evidence list to see its sender, recipients, date and body. Attachments are scanned privately before they are kept.
- Matched messages are kept and assessed automatically. Messages that mention the order but not the customer, or mix several orders, are not kept.
You should seeEvery matched message shows in Communication with its source and time.Disconnect and review Microsoft consent
Revient → Integrations → Microsoft 365 / Outlook → Manage
- Click Disconnect mailbox for the intended account. Revient invalidates its stored access and stops new reads.
- Remove the application's consent in your Microsoft account's app-permission controls as well, or ask the organisation's administrator where that consent is centrally managed.
- After disconnecting, choose Remove account and confirm to clear the account from Integrations. Use Remove email or Remove file on a case if selected evidence should also be erased; account removal keeps it.
You should seeThe Revient connection is DISCONNECTED. Provider-side consent and already retained evidence are managed separately.
Revient operator: configure Microsoft onceRevient operator setup. Customers do not need to register their own Revient app.
Revient operator: configure Microsoft once
The team running Revient creates and maintains this app. This section is not a checklist for each merchant customer.
Register the Revient application and account audience
Microsoft Entra admin center → Entra ID → App registrations → New registration
- Register a recognisable Revient application in the tenant you operate.
- To support business and personal mailboxes, choose the audience containing both any Entra ID tenant and personal Microsoft accounts. Older portal labels describe this as accounts in any organisational directory and personal Microsoft accounts.
- Register the app and keep its Application (client) ID for the deployment configuration.
Provider screenshotOfficial Microsoft example. Choose the business-and-personal audience stated above; the example's default selection and sample app name are not Revient settings. Portal labels can differ.Microsoft: illustrated app-registration guide ↗ You should seeThe application overview shows its client ID and the intended multi-tenant plus personal-account audience.Register the Web callback
App registration → Authentication → Redirect URI configuration → Add Redirect URI
- Select the Web platform. In older portal layouts, the route is Authentication → Add a platform → Web.
- Enter the complete Revient callback shown below and save. Keep this a server-side Web callback rather than a single-page application callback.
Provider screenshotOfficial Microsoft reference for choosing Web. Newer Entra layouts may label the entry point Add Redirect URI.Microsoft: illustrated app-registration guide ↗ You should seeThe Web platform lists the exact callback used by this Revient deployment.Add the three delegated permissions
App registration → API permissions → Add a permission → Microsoft Graph → Delegated permissions
- Add Mail.Read and confirm User.Read is present. Add offline_access for continued delegated access, then save the permissions.
- Check the permission Type is Delegated. Do not choose application Mail.Read or add Mail.Send or Mail.ReadWrite.
- Handle administrator consent where the relevant tenant policy requires it. This does not expand the connector into an organisation-wide mailbox integration.
You should seeThe configured list contains delegated Mail.Read, User.Read and offline_access.Create the testing credential and record its expiry
App registration → Certificates & secrets → Client secrets → New client secret
- Create a client secret for this evidence-testing deployment and record its expiry so it can be rotated before it stops working.
- Save the secret Value into secure deployment configuration immediately; the Secret ID is not the value Revient needs. Do not share the secret in chat or a screenshot.
- The current connector uses a client secret. Microsoft's production guidance recommends certificate or federated credentials; review that deployment requirement before a production launch.
You should seeThe operator has the secret value stored privately and a tracked renewal date.Configure Revient and test each supported account type
Railway → Revient service → Variables, then Revient → Integrations
- Set MICROSOFT_CLIENT_ID, MICROSOFT_CLIENT_SECRET and MICROSOFT_REDIRECT_URI. For the business-and-personal app audience above, set MICROSOFT_TENANT_MODE to common.
- Redeploy while preserving evidence-testing restrictions. Connect an authorised mailbox, find a known case message and retain it with one optional attachment.
- Verify business and personal mailboxes separately before describing both as live-verified. A connected account without a Graph-accessible mailbox will not pass the email search.
You should seeThe Microsoft connection button is available and the case UI can retrieve and retain evidence for the account types actually tested.
Review selected correspondence
Check the source facts and processing result after completing the provider-specific connection steps.
Check the matched email on a case
Revient → selected Case → Evidence
- Automatic checks run on every active case once the mailbox is connected. Messages that mention the order number and involve the customer are kept and assessed; nothing else is kept.
- Open Evidence → Communication on a case to read each matched message. Use Recheck mailbox now under Email to queue a fresh check.
- Revient AI stays unavailable if its approved provider configuration is missing. Deterministic checks and existing evidence remain available.
- Gmail-derived material is excluded from shared learning. Pause automatic checks under Integrations → Manage; disconnect stops future reads without deleting retained case history.
You should seeMatched correspondence appears on the case automatically. No customer messages are sent by Revient.
Match these fields in Revient
Enter your own account’s values. Example values are for orientation; do not paste them as credentials.
| Revient field | Where to find it | Example / guidance |
|---|---|---|
| Microsoft account | Microsoft's account picker after Continue to Microsoft. | Your authorised work/school or personal mailbox |
| Connected mailbox | Case → Evidence → Email shows each connected mailbox and when it was last checked. | The account holding this order's correspondence |
Callback address for the Revient operatorOnly the operator configures this address in the provider application.
Register the complete address, including the path:https://www.revient.io/api/integrations/microsoft/callback
If something goes wrong
Continue to Microsoft is disabled
The Revient operator must supply a valid client ID, secret and callback configuration. A merchant's mailbox password cannot replace this setup.
Administrator approval required
Ask the organisation's administrator to review Revient's delegated permissions under its consent policy. Do not create a new registration to work around that policy.
Personal account is rejected
The operator must check both the registered account audience and MICROSOFT_TENANT_MODE. common supports the mixed flow only when the app registration also permits personal accounts.
Redirect URI or client-secret error
Match the Web callback exactly to MICROSOFT_REDIRECT_URI. Use the application's client ID and the secret Value, not their object/secret IDs. Rotate expired secrets in the operator configuration.
Connected, but email search fails
Confirm this identity has a supported mailbox and that delegated Mail.Read was granted. Reconnect if access has expired or been revoked; check tenant policy for permission errors.
No case matches or an attachment cannot be selected
Check the saved identifiers and displayed date window, then search again. Attachments must meet the shown type and size limits and require an available scanner.
Common questions
Does Outlook supply payment or delivery evidence?
No. Outlook supplies correspondence you choose to keep on a case. Payment authorisation, refunds, returns and tracking come from the store and the carrier.
Must each merchant register an Entra application?
No. Revient operates the application. You sign in to your mailbox and approve access, with administrator involvement only when your organisation requires it.
Does this grant access to every company mailbox?
No. Revient uses delegated access to the signed-in user's mailbox, not application permissions for organisation-wide access. Shared-mailbox and another-user-mailbox selection are not implemented in this connector.
Why does Microsoft mention maintaining access?
offline_access allows Revient to refresh the authorised connection. It does not add permission to send or edit mail. Disconnect in Revient to stop new reads and remove provider consent in Microsoft when required.
Are saved emails automatically sent to staff or AI?
Matched messages are assessed by Revient AI automatically while automatic checks are on; staff reading still needs its own permission. Testing does not enable customer, agency or buyer delivery.
What is the difference between Refresh evidence and Recheck stored evidence?
Refresh evidence queues new reads from available connected sources and already selected mailbox messages, then tracking and reassessment. Recheck stored evidence reassesses the retained facts without claiming a new provider read. Existing findings stay visible until the work finishes; unavailable sources and partial refusals are reported for each case.
Which disputes receive recovery scoring?
Shopify intake accepts only CHARGEBACK disputes with final status LOST and a verified remaining disputed balance. Inquiries, won and open outcomes are excluded before customer enrichment, tracking, scoring and AI. Historical non-qualifying records remain in internal audit history, outside merchant intake and active Cases. An order or tracking number alone does not establish a lost dispute. Supply the actual confirmed loss and preserve its original order and dispute identities.
Will testing send messages or release a case?
Evidence-testing mode blocks customer, agency and buyer delivery. Importing records or reviewing an assessment does not release a case.
What happens when I disconnect?
New reads stop and the Revient connection is disabled. Evidence already retained remains subject to the workspace retention and removal controls. Revoke the application or key in the provider account as well if you want to remove its access there.
Source documentation
Use these provider pages if a menu name has moved or your plan shows different options.
- Microsoft: register an application ↗
- Microsoft: illustrated app-registration guide ↗
- Microsoft: add the Web redirect URI ↗
- Microsoft: configure delegated Graph permissions ↗
- Microsoft: permission definitions ↗
- Microsoft: offline_access ↗
- Microsoft: application credentials ↗
- Microsoft authorisation code flow ↗
- Microsoft delegated consent ↗