Corrisend

For IT admins

How Corrisend connects to your organisation's email, what it can access, and the one-time setup for Microsoft 365.

How it works

  • It runs on each user's own computer, Mac or Windows. There is no Corrisend server and no central database.
  • Each copy connects to one mailbox: its user's own. Users sign in themselves; Corrisend never sees their password.
  • It listens only on that computer (localhost, port 8000). It can't be reached from the network.
  • Sign-in tokens and passwords are stored encrypted in that copy's data folder.
  • Colleagues' copies talk to each other only by email. Automated emails carry their reply rules in hidden headers starting with X-Corrisend-.

What it can access

Permission (Microsoft Graph, delegated)Why it's needed
Mail.ReadWriteRead replies to its own automated emails (last 3 days, Inbox and Junk only)
Mail.SendSend automated emails from the user's own address
User.ReadConfirm the signed-in account matches the user

Corrisend acts only on emails it sent and the replies to them. It doesn't move, delete or file anything in the mailbox.

Microsoft 365 setup

Your organisation registers Corrisend once, in your own Microsoft Entra tenant, so it stays entirely within your organisation. It takes about 10 minutes.

  1. Sign in to entra.microsoft.com as an admin. Go to Applications → App registrations → New registration.
  2. Name: Corrisend. Supported account types: Accounts in this organizational directory only.
  3. Redirect URI: choose Public client/native (mobile & desktop) and enter http://localhost:8000/connect/microsoft/callback. Click Register.
  4. On the Overview page, copy the Application (client) ID and the Directory (tenant) ID.
  5. Authentication: under Advanced settings (or the Settings tab), set Allow public client flows to Yes and save. This allows the sign-in code option.
  6. API permissions → Add a permission → Microsoft Graph → Delegated permissions: tick Mail.ReadWrite and Mail.Send, then Add permissions. User.Read is already listed.
  7. Click Grant admin consent for your organisation, then Yes.
  8. Give your users the two IDs. Each user enters them in Corrisend under Settings → Connections → Microsoft 365 before signing in. They're identifiers, not secrets.
If your Corrisend provider has already configured an app for you, they'll give you an approval link instead. Opening it and clicking Accept replaces steps 1 to 7.

Google Workspace

Users connect with a Google app password, which requires 2-Step Verification on their account. If your organisation has turned app passwords off, allow them for the users who need Corrisend (Admin console → Security → Authentication → 2-Step Verification). A user can delete their app password at any time to cut Corrisend off.

For other providers, Corrisend uses standard IMAP and SMTP over SSL.

Removing access

  • One user: they remove Corrisend at myapps.microsoft.com, or delete their Google app password.
  • The whole organisation: delete Corrisend under Enterprise applications in Microsoft Entra.
  • Uninstalling: close the Corrisend window and delete its folder. Everything it stored is in that folder.