LeadRobin

Connecting LeadRobin to Your Email

LeadRobin watches the inbox where your leads arrive and routes them the moment they land. This guide gets it connected. Most agencies finish in about 20 minutes and need a Microsoft 365 admin for one part of it.

Choose your mailbox type

Your inbox What to use
Shared mailbox (e.g. newquotes@youragency.com, no login or password of its own) Microsoft 365 connection (Option A) — this is the only reliable way; Microsoft blocks direct password access to shared mailboxes
Regular 365 mailbox with a user login Microsoft 365 connection (Option A), or IMAP if your admin prefers it (Option B)
Gmail, Yahoo, cPanel or other IMAP mailbox IMAP connection (Option B)
Website forms, chat tools, or another app that can call an API API or Webhook source (Option C) — no mailbox access at all

Option A: Microsoft 365 (recommended, required for shared mailboxes)

Your admin performs steps A1-A5 in the Microsoft portals. Step A6 is done by anyone with the values from A1-A5.

What we need from you (4 values):

  1. Tenant ID
  2. Application (client) ID
  3. Client secret value
  4. The mailbox address LeadRobin should watch

A1. Find your Tenant ID

  1. Go to https://entra.microsoft.com and sign in as an admin.
  2. Open Identity → Overview (search "Microsoft Entra ID" if the menu looks different).
  3. Copy the Tenant ID — a GUID like a1b2c3d4-.... It is safe to share.

A2. Register the application

  1. In the same portal: Applications → App registrations → New registration.
  2. Name it LeadRobin.
  3. Account type: "Accounts in this organizational directory only".
  4. Redirect URI: leave blank.
  5. Click Register, then copy the Application (client) ID from the overview page.

A3. Create the client secret

  1. In your new app: Certificates & secrets → Client secrets → New client secret.
  2. Description: LeadRobin. Expiry: pick the longest option (24 or 36 months).
  3. Copy the VALUE column immediately — a 38-character string like 8Qj~mX...abc. It displays once and cannot be retrieved later.
  4. Common mistake: the table also shows a Secret ID that looks different. You need the Value.
  5. If what you copied looks like a GUID with dashes, that is the wrong column.

A4. Grant the mail permission

  1. In your app: API permissions → Add a permission → Microsoft Graph → Application permissions (not "Delegated" — Delegated will not work).
  2. Search Mail and add:
  3. Mail.Read
  4. Mail.Send
  5. Click Grant admin consent for [your org] — this is a separate button above the permission list. Without it, everything looks fine and LeadRobin gets "insufficient permissions" errors.

A5. Limit the app to the one mailbox (PowerShell)

This is the safety step: it guarantees the app can only ever touch the single mailbox you choose, even if the secret leaks.

  1. Open PowerShell as administrator and run: powershell Install-Module ExchangeOnlineManagement Connect-ExchangeOnline Sign in with the same admin account.
  2. Run: powershell New-ApplicationAccessPolicy ` -AppId "<client ID from A2>" ` -PolicyScopeGroupId "<mailbox address>" ` -AccessRight RestrictAccess ` -Description "LeadRobin lead intake"
  3. Verify: powershell Get-ApplicationAccessPolicy Your mailbox should appear as the scope for the app.

A6. Add the source in LeadRobin

  1. Log in at app.leadrobin.co → Sources → New source.
  2. Type: Email (poll mailbox). Method: Microsoft Graph API.
  3. Paste the four values (Tenant ID, Client ID, Secret, Mailbox address). Set the poll interval — the default checks the mailbox every 30 seconds.
  4. Save, then send a test inquiry to the mailbox. A LeadRobin card should appear on the board within a minute.

Why can't we just use the mailbox password? Shared mailboxes don't have passwords, and Microsoft rejects direct SMTP/IMAP auth for them with error 535 5.7.139 even when tenants appear to allow it. The OAuth app method above is Microsoft's supported path.

You can also keep your existing routing. If the mailbox already forwards to agents, LeadRobin works alongside that — it reads mail without deleting it, and everything it sends out comes from the same mailbox, so your customers reply to messages that look like they came from you.

Option B: IMAP (any other mailbox)

In LeadRobin: Sources → New source → Email (poll mailbox) → IMAP/SMTP, then fill in the host, port, and credentials below.

Option C: API or Webhook source

No mailbox access at all:

Troubleshooting quick table

Symptom Cause and fix
insufficient permissions / 401 on test Admin consent not granted in A4, or Delegated used instead of Application
AccessDenied on the mailbox Missing A5 policy, or the policy points at a different mailbox than the address entered
Secret not accepted Used the Secret ID instead of the Value, or the secret expired — create a new one
Works, then stops after a while Client secret expired (2-year default) — add a new secret and update the source
IMAP: LOGIN failed for Gmail Using account password instead of an App Password
IMAP: connection times out Host blocks port 993 from outside IPs, or wrong security setting (SSL vs STARTTLS)

Security notes