Skip to main content

​
Overview

FlexDeploy provides a fully managed email service for SaaS environments using Microsoft 365 and Microsoft Graph. This service enables FlexDeploy to send automated workflow notifications and process customer email responses securely without requiring customers to deploy or manage their own email infrastructure. Each FlexDeploy environment, such as DEV and PROD, is assigned a dedicated Microsoft 365 mailbox hosted within Flexagon’s Microsoft 365 tenant. Each mailbox is used exclusively for that environment and is logically separated from other customer environments. Customers may also choose to configure FlexDeploy to use a mailbox hosted within their own Microsoft 365 tenant if they prefer to manage their own email infrastructure.

​
How It Works

​
Outbound Email

FlexDeploy uses Microsoft Graph with OAuth authentication to send workflow-related emails from the customer’s dedicated notification mailbox. Typical emails include:
  • Approval requests
  • Deployment notifications
  • Workflow status updates
Recipients receive these messages as standard email messages sent through Microsoft 365 and can respond using Outlook or any standard email client.

​
Inbound Email

The same dedicated mailbox is monitored by FlexDeploy for incoming email responses. When a user replies to a workflow email, such as approving or rejecting a request, FlexDeploy securely retrieves the message using Microsoft Graph, processes the response, updates the associated workflow, and removes the processed email to prevent duplicate processing.

​
Security

FlexDeploy uses Microsoft’s modern OAuth authentication for Microsoft 365 email integration. Mailbox passwords are not stored within FlexDeploy. Connections between FlexDeploy and Microsoft 365 are authenticated using Microsoft Entra ID and encrypted in transit. Key security characteristics include:
  • OAuth-based authentication using Microsoft Graph
  • No mailbox passwords stored within FlexDeploy
  • Secure communication over Microsoft Graph APIs
  • Dedicated mailbox for each customer environment
  • Separate mailbox configuration and authorization for each environment
  • Centralized management by the Flexagon Operations team

​
Email Authentication

The Flexagon-managed email service follows Microsoft 365 email authentication best practices to help ensure reliable email delivery and protect against email spoofing. The Flexagon email domain is configured with industry-standard email authentication technologies, including:
  • SPF (Sender Policy Framework): Identifies authorized mail servers that can send email on behalf of the Flexagon domain
  • DKIM (DomainKeys Identified Mail): Digitally signs outbound messages, allowing recipient mail systems to verify that messages have not been altered in transit
  • DMARC (Domain-based Message Authentication, Reporting and Conformance): Defines how recipient mail systems should validate authenticated messages and handle messages that fail authentication checks
These standards improve email deliverability, support recipient email security policies, and help protect FlexDeploy notification emails from spoofing or impersonation.

​
Flexagon-Managed Email Service

By default, Flexagon provides and manages the email infrastructure required for FlexDeploy. This includes:
  • Provisioning a dedicated Microsoft 365 mailbox
  • Configuring Microsoft Entra ID OAuth authentication for Microsoft 365 email integration
  • Managing the Microsoft Entra application registration and authorization
  • Maintaining Microsoft 365 email authentication, including SPF, DKIM, and DMARC, for the Flexagon email domain
  • Monitoring and maintaining the email integration
This approach minimizes customer administration while providing a secure and reliable email service.

​
Customer Responsibilities

For customers using the Flexagon-managed email service, no Microsoft 365 configuration is required. Customers simply need to:
  • Receive emails from the Flexagon notification address
  • Allow users to reply to workflow emails
  • Allowlist the Flexagon notification domain if required by internal email security policies
  • If applicable, allow the Flexagon notification domain through email filtering or secure email gateway policies

​
Customer-Managed Email (Optional)

Organizations that prefer to use their own Microsoft 365 tenant and email domain may configure FlexDeploy to connect to a customer-managed mailbox using Microsoft Graph. In this configuration, the customer is responsible for:
  • Provisioning and managing the mailbox
  • Configuring the required Microsoft Entra ID application registration and Microsoft Graph authorization
  • Maintaining the email domain’s SPF, DKIM, and DMARC records in accordance with the organization’s email security policies
FlexDeploy continues to use the same secure Microsoft Graph integration for sending and receiving workflow emails.

​
Benefits

The FlexDeploy email architecture provides:
  • Secure OAuth-based authentication using Microsoft Graph
  • Industry-standard email authentication using SPF, DKIM, and DMARC
  • Dedicated mailbox for each customer environment
  • Separate mailbox configuration and authorization for each environment
  • No mailbox password management
  • Fully managed email infrastructure by Flexagon
  • Reliable bidirectional email communication for workflow automation
  • Optional support for customer-managed Microsoft 365 mailboxes

​
Summary

FlexDeploy’s SaaS email service provides secure, bidirectional communication for workflow automation using Microsoft 365 and Microsoft Graph. Each customer environment is assigned a dedicated mailbox that supports automated notifications and email-based workflow responses while remaining logically separated from other customer environments. Flexagon manages the mailbox, authentication, and email security configuration, including SPF, DKIM, and DMARC, for customers using the Flexagon-managed service. This approach provides a secure, low-maintenance solution while allowing customers the option to integrate with their own Microsoft 365 environment if preferred.