Email
MS Graph Protocol for Email
Automate Desktop 26.1.0 adds Microsoft Graph (MS Graph) as a protocol choice for Email actions, Default Email, and Email Trigger.
Release overview
What to know about Automate Desktop 26.1.0
Automate Desktop 26.1.0 includes updates to Microsoft Grah (MS Graph) support for Email and SFTP behavior. Review the release before upgrading to identify preparation needs, then use the feature pages for configuration, expected behavior, limitations, and troubleshooting.
- Version
- 26.1.0
- Release date
- August 2026
- Features included
- 2
- Areas updated
- EmailSFTP
What changed
Updates in this release
Start with the feature that affects your environment. Each feature page covers scope, preparation, configuration, expected behavior, and troubleshooting where the source provides that guidance.
SFTP
SFTP Enhancements
Automate Desktop 26.1.0 updates SFTP algorithm support, Auto negotiation behavior, Custom cipher selection, and logging controls in Task Builder.
Using this guide
Review what applies before or after upgrading
Review the sections that apply to your environment before upgrading to understand feature impact, or return after upgrading for configuration and troubleshooting. Use this guide alongside the Release Notes, System Requirements, and Installation Guide.
Email
MS Graph Protocol for Email
Automate Desktop 26.1.0 adds Microsoft Graph (MS Graph) as a protocol choice for Email actions, Default Email, and Email Trigger.
- Release
- 26.1.0
- Where it appears
- Task Administrator, Task Builder
01
Overview
Summary
Automate Desktop 26.1.0 adds MS Graph as a protocol choice for Email actions and Default Email. The protocol uses MS Graph App Only authentication for customers moving Email automation away from EWS Online protocol.
MS Graph in this release applies to Email actions, Default Email, and Email Trigger. Exchange actions are not included in Automate Desktop 26.1.0.
What's SupportedMS Graph support in Automate Desktop 26.1.0 applies to Email functionality. It does not add MS Graph support to Exchange actions.
What changes
Email tasks can use MS Graph with App Only authentication instead of EWS Online protocol.
What administrators configure
A Microsoft app registration, application permissions, admin consent, mailbox access, tenant ID, client ID, client secret, and optional proxy.
What task authors see
MS Graph appears as a protocol option in the Email action and Email Trigger, with related fields in Default Email.What to verify
Confirm application permissions, admin consent, mailbox access, field values, proxy requirements, and the Verify result where available.
02
Prerequisites & Preparation
Inventory affected Email tasks
Identify Email actions and Email Triggers that connect to Exchange Online through EWS Online protocol. Exchange actions require separate planning because they are outside this release scope.
Coordinate with the Microsoft tenant administrator
Confirm the app registration process, required application permissions, admin consent, mailbox access scope, and proxy requirements.
Prepare credential handling
Create the client secret using your organization's approved process. Enter the secret only in the Automate field and do not place it in tickets, email, or shared documents.
Validate before production use
Test the app registration, mailbox access, Email action behavior, Email Trigger behavior, and Verify results before changing production tasks.
03
Scope & Limitations
Exchange Online EWS context
Microsoft announced that Exchange Online EWS would no longer receive feature updates and advised developers to move to MS Graph. Microsoft also announced that EWS requests from non-Microsoft applications to Exchange Online will begin to be blocked on October 1, 2026. The retirement applies to Microsoft 365 and Exchange Online, not Exchange Server on-premises.
Customers using Email actions with Exchange Online should assess those tasks for migration to MS Graph. This release does not replace Exchange actions.
What to Know
MS Graph support for Exchange is not included in Automate 26.1.0.
Support is planned for a future release, targeted for Fall 2026.
Timing is subject to change.
Supported behavior
| Area | Automate Desktop 26.1.0 behavior |
|---|---|
| Email action | Included. MS Graph is available as a protocol. |
| Default Email | Included. MS Graph is available as a protocol for Default Email in Task Administrator. |
| Email Trigger | Included. The trigger can poll a mailbox using MS Graph. |
| Exchange actions | Not included in this release. |
| Authentication model | App Only authentication using MS Graph application permissions and admin consent. |
| Delegated user sign-in | Not the authentication model used by this feature. |
04
Configuration
Minimum MS Graph permissions
At minimum, configure these MS Graph application permissions and grant admin consent:
| Permission | Type | Purpose | Important note |
|---|---|---|---|
Mail.ReadWrite | Application | Read and write mail in all mailboxes. | This permission does not include permission to send mail. |
Mail.Send | Application | Send mail as any user. | This permission can send and save a copy even without Mail.ReadWrite. |
Permission reference
The Microsoft app registration should show Mail.ReadWrite and Mail.Send as MS Graph application permissions.
Caption: MS Graph application permissions for mail read, write, and send access.
Configuration workflow
1
Create or confirm the app registration
Use your approved Microsoft tenant and application registration process. Record the tenant ID and client ID.
2
Grant application permissions
Grant at least
Mail.ReadWrite and Mail.Send as application permissions, then grant admin consent.3
Create and secure the client secret
Use your approved secret-handling process. Enter the secret only in the Automate product field.
4
Configure Automate Email fields
Select
MS Graph, then enter the mailbox address, tenant ID, client ID, client secret, and proxy setting when required.5
Run Verify where available
If Verify fails, recheck the tenant, client, secret, mailbox, application permissions, admin consent, and proxy.
Field reference
| Automate field | Value |
|---|---|
| Protocol | MS Graph |
| Email address | Target mailbox address |
| Tenant ID | Microsoft Entra tenant ID |
| Client ID | App registration client ID |
| Client secret | App secret value |
| Proxy | None or your configured proxy |
05
What to Expect
Where MS Graph appears
| Surface | Path | Visible fields |
|---|---|---|
| Email action | Task BuilderEmail | Protocol, session, email address, tenant ID, client ID, client secret, Verify, and advanced fields |
| Default Email | OptionsDefault PropertiesEmail | Protocol, email address, tenant ID, client ID, client secret |
| Email Trigger | TaskTriggers | Protocol, email address, tenant ID, client ID, client secret, Verify, current folder path, proxy type |
Task Builder Email action
The Email action displays MS Graph as the selected protocol and exposes the MS Graph credential fields.
Caption: Email action properties in Task Builder with MS Graph selected.
Default Email setting
In Task Administrator, Default Email settings are available at OptionsDefault PropertiesEmail. Select MS Graph as the protocol, then enter the email address, tenant ID, client ID, and client secret.
Email Trigger configuration
Email Trigger can poll a mailbox using the MS Graph protocol.
Caption: Email Trigger fields with MS Graph selected.
06
Troubleshooting & FAQs
Common issues and checks
| Symptom | First check | Next action |
|---|---|---|
MS Graph is not available in an Exchange action | Confirm that the task uses an Exchange action rather than an Email action. | Exchange actions are outside the 26.1.0 MS Graph scope. Use the Email action where it meets the workflow requirement. |
| Verify fails | Confirm tenant ID, client ID, client secret, email address, application permissions, admin consent, and proxy. | Capture non-secret error details and screenshots with secret values hidden. |
| Send fails but read succeeds | Confirm Mail.Send application permission and admin consent. | Check whether the Microsoft tenant restricts application access to the mailbox. |
| Read or trigger behavior fails | Confirm Mail.ReadWrite application permission and the target folder path. | Review mailbox access scope, folder path, and proxy requirements. |
Important to know
- The 26.1.0 scope covers Email functionality, not Exchange actions.
- The feature uses App Only authentication with application permissions and admin consent.
- Verify is available only on the product surfaces that expose the Verify control.
- Mailbox access scoping is controlled through the customer's Microsoft tenant configuration.
- Do not include client secrets in support cases, email, or shared documents.
SFTP
SFTP Enhancements
Automate Desktop 26.1.0 updates SFTP algorithm support, Auto negotiation behavior, Custom cipher selection, and logging controls in Task Builder.
- Release
- 26.1.0
- Where it appears
- Task Builder
01
Overview
Summary
Automate Desktop 26.1.0 updates SFTP behavior in Task Builder. The release updates the SecureBlackbox library to version 24.0.9600, adds algorithm support, changes Auto cipher behavior, adds multi-selection for Custom cipher dropdowns, and adds SFTP logging levels.
How Auto Selection WorksWhen Auto cipher selection is used, Automate Desktop sends the SecureBlackbox default algorithm list used by Automate Desktop 26.1.0. If the connection is unsuccessful, SecureBlackbox can adjust the proposed list and try again with a modified list.
Compatibility ConsiderationsAuto does not send every newly available algorithm by default and does not guarantee compatibility with every SFTP server. Older servers may reject ETM algorithms during the initial exchange.
Updated algorithm support
The release adds public key, HMAC, and key exchange algorithms and updates the Auto default lists.
Updated Auto negotiation
Auto begins with the 26.1.0 SecureBlackbox defaults and can retry with a modified list when negotiation is unsuccessful.
Custom multi-selection
Custom cipher controls allow multiple selections for encryption, MAC, key exchange, and public key algorithms.
SFTP logging
Log levels include
None, Info, Debug, and Trace. A Log File value is required when logging is enabled.02
Prerequisites & Preparation
Inventory SFTP tasks
Identify tasks connected to older, restricted, or partner-managed servers and record whether each task uses Auto or Custom cipher selection.
Record current algorithm requirements
Capture server-required encryption, MAC, key exchange, and public key algorithms before the upgrade, especially where a trading partner provides a fixed list.
Plan testing
Test connection, authentication, upload, download, and error handling against representative SFTP servers after the upgrade.
Prepare a log path
If you plan to use
Info, Debug, or Trace, confirm that the task has a valid Log File path.03
Scope & Limitations
What to expect
| Area | Release behavior | Important boundary |
|---|---|---|
| Auto cipher selection | Uses the SecureBlackbox default list first and can retry with a modified list. | Auto does not send every available algorithm and does not guarantee compatibility with every server. |
| Custom cipher selection | Allows multiple selections for encryption, MAC, key exchange, and public key algorithms. | Use Custom when a server or partner requires an exact algorithm list. |
| New algorithms | Additional public key, HMAC, and key exchange algorithms are available. | Several newly available algorithms are not included in the Auto defaults. |
| SFTP logging | Adds None, Info, Debug, and Trace. | A Log File value is required when the level is not None. |
04
Configuration
Configuration choices
1
Use Auto for updated negotiation behavior
Auto sends the 26.1.0 SecureBlackbox default list first. If negotiation is unsuccessful, SecureBlackbox can adjust the proposed algorithm list and attempt another connection.
2
Use Custom for exact algorithm control
Custom cipher dropdowns allow multiple selections for encryption, MAC, key exchange, and public key algorithms.
3
Configure logging
Logging defaults to
None. If Info, Debug, or Trace is selected, the Log File field is required. If a task already has a Log File value, the level becomes Info for backward compatibility.Available new algorithms
| Category | Algorithms listed as newly available |
|---|---|
| Public key | MLDSA_44, MLDSA_65, MLDSA_87, ECDSA_SK, ED25519_SK |
| HMAC | HMAC_SHA2_256_ETM, HMAC_SHA2_512_ETM |
| Key exchange | MLKEM768_NISTP256_SHA256, MLKEM1024_NISTP384_SHA384, MLKEM768_X25519_SHA256 |
This release corrects ECDH_NIST_P512 to ECDH_NIST_P521.
Newly available algorithms not sent by Auto by default
Auto uses the SecureBlackbox default list, not the full set of newly available algorithms. Based on the available-algorithm list and the Auto defaults listed for Automate Desktop 26.1.0, the following newly available algorithms are not sent by Auto by default.
| Category | Newly available algorithms not sent by Auto by default |
|---|---|
| Public key | MLDSA_44, MLDSA_65, MLDSA_87, ECDSA_SK, ED25519_SK |
| HMAC | None. HMAC_SHA2_256_ETM and HMAC_SHA2_512_ETM are included in the provided MAC Auto defaults. |
| Key exchange | MLKEM768_NISTP256_SHA256, MLKEM1024_NISTP384_SHA384, MLKEM768_X25519_SHA256 |
Post-change Auto defaults
These are the algorithms sent when Auto cipher selection is used. Automate Desktop uses the SecureBlackbox default list for Auto, so this is not the same as the full set of algorithms available in the product.
MAC defaults
HMAC_SHA1, HMAC_SHA256, HMAC_SHA256_96, UMAC32, UMAC64, HMAC_SHA2_256, HMAC_SHA2_512, AES128_GCM, AES256_GCM, POLY1305, HMAC_SHA2_256_ETM, HMAC_SHA2_512_ETMEncryption defaults
EA_3DES_CBC, EA_AES256_CBC, EA_AES192_CBC, EA_AES128_CBC, EA_AES128_CTR, EA_AES192_CTR, EA_AES256_CTR, EA_AES128_GCM, EA_AES256_GCM, EA_AES128_GCM_OPENSSH, EA_AES256_GCM_OPENSSH, EA_CHACHA20, EA_CHACHA20_OPENSSHKey exchange defaults
DH_GROUP_EXCHANGE, DH_GROUP, DH_GROUP_14, DH_GROUP_EXCHANGE256, RSA1024_SHA1, RSA2048_SHA256, ECDH_NIST_P256, ECDH_NIST_P384, ECDH_NIST_P521, ECDH_CURVE25519, CURVE25519, CURVE448, DH_GROUP_14_SHA256, DH_GROUP_15_SHA512, DH_GROUP_16_SHA512, DH_GROUP_17_SHA512, DH_GROUP_18_SHA512Public key defaults
RSA, ECDSA_NIST_P256, ECDSA_NIST_P384, ECDSA_NIST_P521, ECDSA_CURVE25519, X509_ECDSA_SHA2_NIST_P256, X509_ECDSA_SHA2_NIST_P384, X509_ECDSA_SHA2_NIST_P521, X509_ECDSA_SHA2_CURVE25519Default changes from previous Auto behavior
| Area | Change | Algorithms or notes |
|---|---|---|
| MAC added | Added to Auto defaults | HMAC_SHA2_256_ETM, HMAC_SHA2_512_ETM |
| MAC removed | Removed from Auto defaults | HMAC_SHA1_96, HMAC_MD5, HMAC_MD5_96, NONE, HMAC_RIPEMD160, HMAC_RIPEMD, HMAC_RIPEMD_OPENSSH, UMAC96, UMAC128 |
| Encryption added | Added to Auto defaults | No additions are identified for this category. |
| Encryption removed | Removed from Auto defaults | EA_BLOWFISH, EA_TWOFISH256, EA_TWOFISH192, EA_TWOFISH128, EA_SERPENT256, EA_SERPENT192, EA_SERPENT128, EA_ARCFOUR, EA_IDEA, EA_CAST128, EA_NONE, EA_DES, EA_3DES_CTR, EA_BLOWFISH_CTR, EA_TWOFISH128_CTR, EA_TWOFISH192_CTR, EA_TWOFISH256_CTR, EA_SERPENT128_CTR, EA_SERPENT192_CTR, EA_SERPENT256_CTR, EA_IDEA_CTR, EA_CAST128_CTR, EA_ARCFOUR128, EA_ARCFOUR256 |
| Key exchange added | Added to Auto defaults | RSA1024_SHA1, RSA2048_SHA256, ECDH_NIST_P256, ECDH_NIST_P384, ECDH_NIST_P521, ECDH_CURVE25519, CURVE25519, CURVE448, DH_GROUP_14_SHA256, DH_GROUP_15_SHA512, DH_GROUP_16_SHA512, DH_GROUP_17_SHA512, DH_GROUP_18_SHA512 |
| Public key added | Added to Auto defaults | No additions are identified for this category. |
Earlier Auto behaviorWhen a server requires an algorithm set that was used before 26.1.0, select
Custom and configure the required algorithms explicitly.05
What to Expect
Visible configuration changes
| Area | 26.1.0 behavior | Planning note |
|---|---|---|
| SFTP logging | Log levels are None, Info, Debug, and Trace. | The default is None. Log File is required when another level is selected. |
| Existing Log File value | If a task already has a Log File value, the logging level becomes Info. | This preserves logging behavior for existing tasks. |
| Custom cipher selection | Cipher dropdowns allow multiple selected values. | Use Custom when exact algorithms are required. |
| Auto cipher selection | Auto uses the updated SecureBlackbox negotiation behavior. | Older servers may still reject ETM algorithms during the initial exchange. |
Custom cipher multi-selection
Custom cipher combo boxes support multiple selected algorithms.
SFTP logging levels
The Log level dropdown provides four values.
None, Info, Debug, and Trace. None is selected.06
Troubleshooting & FAQs
Common checks
1
Identify Auto or Custom
Confirm whether the SFTP action uses Auto or Custom cipher selection. This determines whether negotiation behavior or the selected algorithm list is the first area to review.
2
Review server restrictions
Determine whether the connection targets an older, restricted, or partner-managed server. Some older servers may reject ETM algorithms during the initial exchange.
3
Check logging configuration
If logging is set to
Info, Debug, or Trace, confirm that the Log File field contains a valid path.4
Use Custom when exact control is required
If Auto fails and negotiation appears to be involved, configure Custom to match the server's required algorithm list.
Additional considerations
| Item | Guidance |
|---|---|
| Auto compatibility | Auto can retry with a modified list, but it may still fail when an older server rejects ETM algorithms during the initial exchange. |
| Earlier algorithm sets | Use Custom selection when the server requires an exact list that differs from the 26.1.0 Auto defaults. |
| Logging path | A Log File value is required for Info, Debug, or Trace. |
When contacting Fortra SupportProvide the Automate Desktop version, SFTP server type, Auto or Custom selection, selected algorithms when Custom is used, the exact non-secret error text, and the configured log level.