> ## Documentation Index
> Fetch the complete documentation index at: https://docs.abbyy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Importing images using Microsoft Graph Mail API

> Import e-mail document images into FlexiCapture 12 via the Microsoft Graph Mail API: grant mailbox permissions and complete OAuth 2.0 authorization.

ABBYY FlexiCapture 12 lets you automatically import and process document images from your e-mail via the Microsoft Graph Mail API. To be able to do so, you need to create an appropriate image import profile. For more information, see [Image import profiles](/flexi-capture/project-settings/import-profiles).

To access your e-mail, an application called FlexiCapture 12 Graph Mail Import is used. To finish setting up your import profile, log in to your Microsoft account and grant the following permissions to the FlexiCapture 12 Graph Mail Import application:

* Maintain access to data you have given it access to
* Sign you in and read your profile
* Read your mail
* Read and write access to your mail
* Read and write mail you can access

Permission identifiers:

<table width="100%"><tbody><tr><td><p>Mail permissions:</p></td><td><p>Mail.Read</p><p>Mail.ReadWrite</p><p>Mail.ReadWrite.Shared</p></td></tr><tr><td><p>OpenID permissions:</p></td><td><p>email</p><p>offline\_access</p><p>openid</p><p>profile</p></td></tr><tr><td><p>User permissions:</p></td><td><p>User.Read</p></td></tr></tbody></table>

For more information about permissions, visit the official Microsoft website ([https://docs.microsoft.com/en-us/graph/permissions-reference/](https://docs.microsoft.com/en-us/graph/permissions-reference)).

<Note>
  You cannot change the e-mail import application or modify the permissions granted to it.
</Note>

Depending on your security settings, one of the following will happen on your first authorization attempt:

* Access will be granted.
* Permission from the administrator will be required before you are granted access (for more information, see [the official Microsoft website](https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access)).

## OAuth 2.0 authorization

To set up image import via the Microsoft Graph Mail API, OAuth 2.0 authorization is required. For more information about the authorization process, see [the official Microsoft website](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow) and section 4.1 of the [OAuth 2.0 Framework](https://tools.ietf.org/html/rfc6749#section-4.1).

Once authorized, you will be automatically directed to [https://go.abbyy.com/oauth2redirect](https://go.abbyy.com/oauth2redirect), which will further redirect you to [https://127.0.0.1](https://127.0.0.1). If the authorization is successful, you can navigate back to the authorization wizard and continue setting up the import profile.

<Note>
  Sometimes, after confirmation of authorization is received, the authentication is denied with the following error message: **Flow failed. Failure info/error: Connect to token endpoint failed** (for more information, see [Microsoft Graph API connection error](/flexi-capture/tg-integration-ms-graph-import-error)).
</Note>

<Note>
  Redirection to [https://go.abbyy.com/oauth2redirect](https://go.abbyy.com/oauth2redirect) is required in order to make use of the HTTPS protocol (for more information, please see [the official Microsoft website](https://docs.microsoft.com/en-us/azure/active-directory/develop/reply-url#supported-schemes)). This step is completely safe: data collection is disabled at [https://go.abbyy.com/oauth2redirect](https://go.abbyy.com/oauth2redirect), and no other actions are performed.
</Note>

During the import, the primary refresh token is replaced with secondary access and refresh tokens, which are used for authorization and to access your e-mail via the Microsoft Graph Mail API. Administrator permissions are not required, as access is provided only to a specific user or a specific mail box.

<Note>
  By default, the refresh token required to use the Microsoft Graph Mail API will expire after 90 days of inactivity and you will need to re-authenticate to obtain a new token. The token lifetime can be configured by an Active Directory administrator (see [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-configurable-token-lifetimes) for details).
</Note>

<Note>
  When setting up an import profile on the Project Setup Station, connection to the mail box will be established by the computer where the Project Setup Station is opened. For automatic import tasks, connection to the mail box will be established by Processing Station computers.
</Note>