Gallery-edition support

About this edition

The add-on uses Microsoft Graph to find the exact Outlook message by its RFC Message-ID. It reads Outlook reaction properties using delegated Exchange mailbox access because those properties are not included in the IMAP message or Microsoft Graph message response.

This Gallery edition uses only standard Thunderbird MailExtension APIs. It keeps the inline reaction bar, toolbar popup, emoji counts, reactor details, multi-account support, and exact Outlook link.

Setup

The Entra registration and consent steps may require your Microsoft 365 administrator.

Part 1Install and copy the redirect URI

1. Install the Gallery-edition XPI in Thunderbird 140 or later.
2. Open the add-on's Preferences.
3. Copy the exact value displayed under Entra SPA redirect URI.

Use the value shown by the add-on. Do not use a moz-extension:// address or a URI copied from another extension.

Part 2Configure Microsoft Entra

1. Open Microsoft Entra admin center → Identity → Applications → App registrations.
2. Create or open the application, then copy its Application (client) ID and Directory (tenant) ID.
3. Open Authentication → Add a platform → Single-page application.
4. Paste the exact redirect URI from the add-on and save.
5. Do not create a client secret. Allow public client flows is not required by this edition.

Add the Graph permissions under Microsoft Graph → Delegated permissions. Add EWS under APIs my organization uses → Office 365 Exchange Online → Delegated permissions. Grant admin consent if your tenant requires it.

Part 3Connect each mailbox

1. Enter the tenant ID/domain and client ID in the matching Thunderbird account card.
2. Tick the account's consent checkbox to enable Connect, then select Save and Connect Microsoft account.
3. Complete the first Microsoft window for Graph access.
4. Complete the second Microsoft window for Exchange reaction access.
5. Confirm that Connected as shows the correct mailbox, then repeat for other accounts.

Connections made by the full/direct device-code edition must be connected once again in this build.

Using the add-on

• Open an email. When it has Outlook reactions, a reaction bar appears above the message body.
• Select Who reacted to see names and email addresses.
• Select the toolbar Reactions button for the popup and manual refresh.
• Select Open Outlook to react to open the exact message in Outlook on the web.

The add-on displays reactions but cannot create, change, or remove them because Microsoft does not publish a supported Outlook reaction write API.

Background sign-in renewal

Microsoft gives SPA refresh-token chains a fixed 24-hour lifetime. Version 0.5.1 starts a standard, non-interactive authorization flow after 18 hours to obtain a new chain while the Microsoft browser session is still valid. Failed silent attempts are retried later and do not invalidate a still-valid access token.

Microsoft can still require an interactive reconnect after sign-out, cookie removal, password or MFA changes, administrator revocation, Conditional Access, or tenant policy. The add-on cannot bypass those security decisions.

Authentication goes directly to login.microsoftonline.com. The add-on has no intermediary authentication server.

Troubleshooting

Privacy policy

Effective August 14, 2026 · Applies to Gallery edition 0.5.1

Purpose and data handled

The add-on connects a Thunderbird account to the Microsoft 365 mailbox chosen by the user. It handles OAuth authorization codes and tokens, tenant/client configuration, the connected user's Microsoft profile identity, and the displayed message's RFC Message-ID. When needed to resolve a match, it also uses the message subject, sender, and sent/received time. Reaction results contain reaction types and reactor names or addresses.

Where data is sent

• login.microsoftonline.com for Microsoft authentication and tokens.
• graph.microsoft.com to identify the user, locate the selected message, obtain its Outlook link, and translate its Exchange identifier.
• outlook.office365.com to read the selected message's Outlook reaction properties.

No personal, authentication, message, reaction, usage, analytics, advertising, or diagnostic data is sent to the add-on developer or any non-Microsoft service.

Storage and retention

Tenant/client configuration, connected Microsoft profile details, and OAuth tokens are stored in Thunderbird extension storage in the local Thunderbird profile. Reaction results are held in memory for up to five minutes. Disconnect removes an account's tokens and profile; its non-secret tenant/client configuration remains for reconnection. Thunderbird removes extension storage under its normal uninstall behavior.

User choice and cookies

The add-on does not contact Microsoft for an account until the user configures it, ticks that account's consent checkbox (which restates exactly what is sent and to which Microsoft services), and selects Connect Microsoft account. The user can cancel authorization, disconnect, revoke consent in Microsoft, or uninstall. Authentication, personal-communication, and identity data are necessary for the core feature, so no reduced-data mode is available.

The add-on does not create cookies. Microsoft may use its own session cookies in Thunderbird's authentication window; blocking or deleting them can prevent silent renewal and require an interactive reconnect.

Security and technical limits

All external requests use HTTPS and are restricted to the three Microsoft origins above. The build contains no remote executable code, developer-operated authentication server, or custom Thunderbird Experiment API. It depends on delegated EWS because Outlook reaction properties currently have no supported Microsoft Graph equivalent.

Privacy/support contact: m365-reactions@jamesmorgan.ca.