Mail

FAQ › EUZOS Desktop › Mail · Nederlands

What is it?

Email is EUZOS's own mail app (in the mega menu and the welcome panel), with its own code for Microsoft 365 (Microsoft Graph) and generic IMAP/SMTP. Mail is kept in memory: a cache in RAM, wiped on logout; a bounded, encrypted copy of the cache is written to the user's profile directory on logout, never to the stick. Microsoft login uses the device code flow, shared with the Explorer (OneDrive, SharePoint) through one Microsoft session. The console has mail (test IMAP/SMTP) and microsoft (the shared Microsoft session).

EUZOS Desktop only.

How do I…?

How do I add a Microsoft 365 account?

In Email choose Add account › Microsoft 365. The app shows a short code and the address https://microsoft.com/devicelogin; open that on a phone or PC, enter the code and confirm (Accept). Outlook.com accounts also go through this Microsoft login (Outlook.com no longer accepts passwords on IMAP/SMTP).

Why does Microsoft say "Admin approval required"?

Your organisation does not let users accept apps. The organisation's admin gives consent once for the whole organisation (admin consent), via the adminconsent address or in Entra › Enterprise applications › EUZOS › Permissions › Grant admin consent. See docs/MAIL.md, "For IT admins".

How do I add an IMAP account (Gmail, Proton, others)?

Add account › another provider: name, email address, user name, password (a secret field; kept only in memory), IMAP and SMTP server and port. The address guesses the provider and pre-fills Gmail (imap.gmail.com:993, smtp.gmail.com:587; use an app password) and Proton Mail Bridge (127.0.0.1, IMAP 1143 and SMTP 1025 with STARTTLS; for a Bridge on another PC, trust its certificate with \EOS\FW\EXTRA.PEM).

Do I have to log in to Microsoft again on every PC?

No. After a successful login the Microsoft refresh token is stored encrypted in the vault on the profile server (ms-refresh:<id>) and encrypted in your profile directory. After you log in on a PC, EUZOS links the account by itself and shows "Connected to Microsoft (automatically)". A new code is only needed when Microsoft revokes the token. IMAP passwords are never stored: after login the app shows Password to enter it again.

How do I add a shared mailbox?

Right-click the Microsoft 365 account in the left column (or long-press it, or use the gear on the selected account) and choose Settings. Under Shared mailboxes: Add shared mailbox…, enter the address (for example info@company.com) and Add. It appears as its own tree under the account; Delete next to it in the same list removes it. Sending goes first "as" the mailbox (Send As), otherwise "on behalf of" (Send on Behalf); the Exchange admin decides which permission you have. If consent is missing, the mailbox shows "Permission needed: sign in again".

How does mail come in by itself, and how do I delete a mailbox?

Synchronize in the toolbar fetches the shown folder now. In the mailbox's Settings (right-click on it, or the gear), Synchronize automatically can be off or every 1, 5, 10 or 30 minutes; it is kept per mailbox in your encrypted profile folder. Delete mailbox in the same Settings asks first, then removes the account, the local copy of its mail and its stored sign-in from this PC (with a Microsoft account also its shared mailboxes); the mail on the server stays.

Why are images in a mail not shown?

External images are blocked by default (privacy, tracking pixels). A yellow bar offers Show images, which loads the images of that one message for this session. Inline images (cid:) are always shown. HTML mail is drawn by EUZOS's own web engine, without JavaScript.

How do I read, delete and navigate with the keyboard?

Arrow up/down move the selection, Enter opens, Delete moves the message to Deleted Items (no confirmation; recoverable from the trash), Esc closes a form or goes back to the list in a narrow window. Backspace never deletes mail. A message counts as read after 2 seconds in the reading pane, or right away when you open it.

How do I test an IMAP or SMTP server from the console?

• mail test <server>[:port]: without logging in, connect with TLS or STARTTLS and show CAPABILITY (IMAP 993/143) or EHLO (SMTP 465/587/25).
• mail imap <server>[:port] <user> [smtp-server[:port]]: log in (the password is asked afterwards in a secret field), show the folders and the last 10 messages of INBOX.
• mail send <smtp-server>[:port] <user> <to>: send a test message.

The password is never typed on the command line, so it is not in the history or the log. Via SSH the password question appears on the PC's own screen.

How do I check the Microsoft session from the console?

microsoft (or microsoft status) shows the Entra app tenant from MSAPP.TXT and per account its state (busy, waiting for confirmation with seconds left, logged in, error). microsoft login starts a login (the code appears in the Email app), microsoft again <id> logs an account in again, microsoft forget <id> forgets it (also from the vault), microsoft graph <path> does a GET on Graph with the first account (prints only status and size), microsoft imap <id> checks whether a token for IMAP/SMTP (XOAUTH2) can be obtained.

Why does the app say "Microsoft 365 is not set up on this PC"?

\EOS\FW\MSAPP.TXT is missing or invalid. It holds the client id of the EUZOS Entra app (the same for everyone) and optionally the tenant.

Details

• Model: the app only talks to the trait euzos_mail::Mailbox (folders, list, message, attachment, mark, move_to, delete, send, save_draft, close); GraphMailbox (Microsoft 365) and ImapMailbox (IMAP/SMTP) implement it. Calls block and run on a thread of their own, one action at a time per account.
• Cache (euzos_mail::Cache): at most 5000 headers per folder and 64 MiB content, least recently used evicted and wiped. On logout a bounded copy goes encrypted to the profile directory (systeem/mail/<hash of the address>: 100 folders, 300 newest headers per folder, 2 MiB read content, file at most 4 MiB, no passwords or tokens) and is read back when the directory opens.
• Logout (profile::clear_user) calls mail::wipe, mailapp::wipe and microsoft::wipe: running connections abort (a generation counter), tokens and codes are wiped. The vault and the profile directory keep the refresh token (that is the point).
• IMAP (IMAP4rev1 and IMAP4rev2): no login without TLS; PREAUTH rejected; XOAUTH2, PLAIN or LOGIN; SASL-IR; UID commands, MOVE (or COPY
  • EXPUNGE), APPEND, IDLE. Limits: line 4 MiB, literal 40 MiB, response 48 MiB. Messages up to 8 MiB whole, above that part by part.
• SMTP: 587 with STARTTLS or 465 with TLS; no AUTH without TLS; XOAUTH2, PLAIN or LOGIN; Bcc only in the envelope.
• Microsoft Graph (v1.0): folders via /me/mailFolders, list via …/messages?$top=50, sendMail, createReply, move, permanentDelete, drafts; shared mailboxes under /users/{address}. JSON responses at most 8 MiB.
• Microsoft tokens: access tokens only in RAM; refreshed five minutes before expiry and once more after a 401; on 429/503 one wait for Retry-After (≤ 10 s). Nothing of codes, tokens or addresses goes into the log.
• Not yet: CONDSTORE/QRESYNC, format=flowed, S/MIME, POP3, PDF attachments, forwarding with attachments, sending more than 3 MiB via Graph.

Reference

Console commands

Functions and modules

Config files

Profile setting (on the wire, value gedeeld stays Dutch), at most 16 lines, never passwords or tokens:

mail-account=microsoft<TAB><address><TAB><name>
mail-account=imap<TAB><address><TAB><name><TAB><user><TAB><imap-host>:<port><TAB><smtp-host>:<port>
mail-account=gedeeld<TAB><address><TAB><owner>

Since 27-10-2026 EUZOS writes English config file names, keys, values and confirmation words (for example WIPE-…, environment= in PROFILE.TXT); the old Dutch names (marked legacy here) are still read and accepted (docs/ENGLISH.md).

API endpoints

Protocol messages and formats

See also

• docs/MAIL.md: the full design (model, IMAP, SMTP, Graph, app, shared mailboxes, what is stored where)
• docs/EXCEPTIONS.md, U-20 (Microsoft Graph)
• docs/PROFILE-PROTOCOL.md, "The vault"
• Explorer (OneDrive with the same Microsoft session), Storage (profile directory, vault)