- Home
- /
- Article
Thanks for your feedback.
In this article
Feedback?Create and authenticate an email digital asset in Control Hub, then assign it to a Webex service such as Webex Connect or Webex Contact Center.
Overview
Use Digital Assets in Control Hub to configure the mailbox and OAuth 2.0 authentication that Webex services use for email interactions. You manage the asset in Control Hub, and approved Webex workloads access it through the shared digital asset service.
When you create the asset, assign it to the Webex service that will use it. After authentication succeeds, Control Hub generates a forwarding address for inbound email. For Webex Contact Center, you can then associate the asset with an email entry point. For another Webex workload, continue setup in that workload after you create the asset.
Before you begin
- Sign in to Control Hub as a full administrator, customer administrator, or partner administrator who can manage digital assets for your organization.
- Use a supported email provider. For the Webex Contact Center integration with Webex Connect, Gmail and Microsoft 365 are the supported providers. For provider-specific details, see Email - WXCC.
- Prepare the mailbox you want to configure. If you use a service account, make sure it can send email and access that mailbox.
- Work with your identity-provider administrator to register an OAuth application, grant consent, and turn on provider settings such as SMTP AUTH or external forwarding.
- Be ready to copy the Call Back URL from Control Hub into the OAuth application's redirect URL and to configure automatic forwarding to the address generated for the email asset.
Prepare Gmail for OAuth 2.0
To prepare a Gmail account for the email asset:
| 1 |
Sign in to the Google Cloud console and create a project or select an existing project. |
| 2 |
Go to APIs & Services > OAuth consent screen, select External, and enter the App name, User support email, and Developer contact information. |
| 3 |
If the app stays in Testing, add the mailbox or token-generation identity as a test user. A project can have up to 100 test users. |
| 4 |
Go to APIs & Services > Credentials, create an OAuth client ID for a Web application, and copy the Client ID and Client Secret. |
| 5 |
When Control Hub shows the Call Back URL, return to the OAuth client and add that value as an authorized redirect URI. |
| 6 |
For production use, publish the OAuth app and complete any Google verification required for the requested scope. |
| 7 |
Record the following provider values for the Control Hub configuration:
For an External Google OAuth app in Testing, test-user authorizations and refresh tokens expire seven days after consent. Publish the app for production use. If Google doesn't return a refresh token, run the consent flow again and select I would like to explicitly review before providing consent for authentication when that option is available. Google's SMTP OAuth documentation explains the Gmail SMTP OAuth scope. Google's OAuth audience guidanceexplains Internal and External audiences and publishing-status behavior. |
Prepare Microsoft 365 for OAuth 2.0
To prepare a Microsoft 365 mailbox for the email asset:
| 1 |
In the Microsoft Entra admin center, go to App registrations, select New registration, and register the application for the account types your organization allows. |
| 2 |
Record the Application (client) ID and Directory (tenant) ID. |
| 3 |
In Authentication, add a Web platform. When Control Hub shows the Call Back URL, add that value as the redirect URI. |
| 4 |
In Certificates & secrets, create a client secret and copy its Value before you leave the page. |
| 5 |
For the interactive authorization code flow used when you select Generate tokens, add the delegated Office 365 Exchange Online SMTP.Send permission ( https://outlook.office.com/SMTP.Send) and request the offline_access scope. Grant administrator consent if your organization's consent policy requires it. |
| 6 |
In the Microsoft 365 admin center, go to Users > Active users, select the mailbox user, select Mail > Manage email apps, turn on Authenticated SMTP for that mailbox, and save your changes. |
| 7 |
Record the following provider values. Replace {tenant-id} with the Directory (tenant) ID from the app registration:
Use the delegated https://outlook.office.com/SMTP.Send scope with offline_access for this interactive token flow. Enable SMTP AUTH only for the mailbox that needs it. If your organization recently changed Microsoft Entra consent settings, wait for the changes to take effect before you generate tokens. Microsoft's SMTP OAuth guidance covers delegated SMTP.Send and offline_access. Microsoft's SMTP AUTH configuration explains how to enable SMTP AUTH for a specific mailbox. |
Configure the email asset in Control Hub
To configure an email asset:
| 1 |
Sign in to Control Hub. |
| 2 |
Go to Services > Digital Assets. |
| 3 |
Select Create asset. |
| 4 |
In the Configure asset details section, enter values in the following fields:
|
| 5 |
In Email provider > Mailbox, enter the email address of the mailbox that the asset uses. |
| 6 |
In the OAuth 2.0 Authentication section, enter values in the following fields:
|
| 7 |
In your identity provider, add the Call Back URL from Control Hub to the OAuth application, save the provider configuration, and confirm that the redirect URI matches exactly. |
| 8 |
If the person granting consent uses a different email address from the mailbox, select Generate tokens using a different email address than the mailbox address and enter that identity. Shared mailbox: A shared mailbox doesn't have its own sign-in credentials. Generate tokens with a user who can access the shared mailbox and has Send As permission; the user doesn't need administrator access. Select Generate tokens using a different email address than the mailbox address when that user's address differs from the mailbox. |
| 9 |
Select Generate tokens, complete the identity-provider sign-in and consent flow, and return to Control Hub. After token generation succeeds, the Access token, Refresh token, and Validity fields are filled in automatically. Consent restriction: If your provider blocks user consent, clear I would like to explicitly review before providing consent for authentication. The option can cause authentication to fail because the user can't grant the requested consent. Ask the provider administrator to grant the required consent instead. If token generation doesn't work: For Gmail, make sure the user can authorize the app and that the app has the correct publishing status. For Microsoft 365, check the offline_access scope, consent policy, redirect URI, and SMTP AUTH setting. Fix the provider configuration, and then generate the tokens again. Token renewal: The service refreshes tokens before they expire. If a tenant owner receives an automated email asking for token regeneration, open the asset and select Generate tokens again. |
| 10 |
After token generation succeeds, select Create. If the asset is assigned to Webex Contact Center, select Go to Entry Points and continue the Contact Center configuration. For another Webex workload, close the confirmation page and continue setup in that workload. |
Configure inbound email forwarding
First, copy the forwarding address generated for the asset:
| 1 |
In Digital Assets, open the email asset and select Settings. |
| 2 |
In Email provider > Mailbox, copy the Forwarding address associated with the mailbox email address. |
Configure forwarding in Gmail
To forward incoming Gmail messages to the email asset:
| 1 |
If you use Google Workspace, make sure your administrator allows Automatic forwarding for the mailbox's organizational unit under Apps > Google Workspace > Gmail > End User Access. |
| 2 |
Sign in to the support mailbox in Gmail and go to Settings > See all settings > Forwarding and POP/IMAP. |
| 3 |
Select Add a forwarding address, paste the Forwarding address from Control Hub, and then complete the confirmation prompts. Gmail sends a verification link or code to the generated address. |
| 4 |
Retrieve the verification link or code from the Outbound Webhook payload for inbound email in Webex Connect or from the full email body in the email asset's decrypted Debug Logs. Then complete the Gmail verification. |
| 5 |
Return to Gmail forwarding settings, refresh the page, select Forward a copy of incoming mail to, choose what Gmail should do with its copy, and select Save Changes. |
Configure forwarding in Microsoft 365
To forward incoming Microsoft 365 messages to the email asset:
| 1 |
Configure mailbox forwarding or an Inbox rule for the support mailbox so that new messages are sent to the Forwarding address from Control Hub. |
| 2 |
In the Microsoft Defender portal, review the outbound spam policy that applies to the mailbox. Set Automatic forwarding rules to On - Forwarding is enabled in a narrowly scoped policy that your security administrator has approved. |
| 3 |
In Exchange Online, make sure the applicable remote-domain setting allows automatic forwarding to the forwarding-address domain. |
| 4 |
Review the Exchange mail flow rules and make sure no rule blocks automatically forwarded messages. If you need an exception, limit it to the support mailbox and approved destination. |
| 5 |
Save the forwarding configuration and allow time for the Microsoft 365 policy changes to take effect. Required: Inbound email won't reach the assigned Webex workload until forwarding is enabled. In Microsoft 365, a blocking outbound-spam policy, remote-domain setting, or mail flow rule takes precedence over a setting that allows forwarding. Attachment limit: Inbound email attachments are limited to 25 MB. If a message fails because its attachments are too large, the sender receives a delivery-failure message and must resend it with smaller attachments. Inline images: Inline images arrive as attachments on the agent desktop. If PCI scanning is enabled, those images are blocked. Microsoft Outlook attachments: An inbound email with a .msg attachment might arrive without the files embedded in that .msg because of a Microsoft Outlook limitation. |
Test the email asset
To verify the complete email path:
| 1 |
From an external email account, send a message to the configured support mailbox and make sure the message reaches the assigned Webex workload. |
| 2 |
From the assigned Webex workload, send a new message or reply to the inbound message and make sure the external recipient receives it. Delivery status: Email sent through the SMTP channel doesn't include delivery tracking, and the service doesn't receive delivery-failure notifications. Confirm delivery from the recipient mailbox during testing. |
| 3 |
If inbound delivery doesn't work, check the provider's forwarding-address confirmation, forwarding rule, and organization forwarding policies. |
| 4 |
If outbound sending doesn't work, check the SMTP server and port, provider permissions, client credentials, consent, Microsoft 365 SMTP AUTH setting, and token status. Fix the issue and generate tokens again if needed. |
