FortiPAM : Email Approval Template and Email settings issues

Hello henry63, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Hello again henry63,

I found this solution. Can you tell us if it helps, please?

FortiPAM Email Approval Workflow with Microsoft Exchange

When FortiPAM is configured to send and process approval emails, it relies on SMTP for sending messages and IMAP or POP3 for retrieving reply emails. Since your organization uses Microsoft Exchange Server instead of an internal mail relay, the issue arises when FortiPAM cannot fully process the approval because Exchange restricts how reply messages are composed or authenticated.

Typical Cause of the Problem:

• The 'Approve' button creates a new email instead of an inline reply, so FortiPAM cannot match the approval token with the original request.
• The service account under which FortiPAM connects to Exchange may not have the necessary IMAP access or the mailbox may not be configured for programmatic access.
• If multiple FortiPAM instances use the same mailbox, only one system can retrieve and process reply messages correctly.

Recommended Configuration for Microsoft Exchange Integration

1. Enable IMAP Access:
   Ensure that IMAP is enabled for the FortiPAM service account in Exchange (can be configured via Microsoft 365 Admin Center or Exchange Admin Shell).
2. SMTP/IMAP Settings:

• SMTP Server: smtp.office365.com, Port 587 (STARTTLS).
• IMAP Server: outlook.office365.com, Port 993 (SSL/TLS).
• Authentication: Use user principal name (e.g., fortipam@domain.com) and an App Password if MFA is enforced.

3. Dedicated Mailbox:
   Assign one exclusive mailbox to FortiPAM. Do not share it with other applications.
4. Workaround for Reply Issue:
   Advise approvers to use the reply action in the same message thread instead of clicking “New Email” when approving. Alternatively, enable portal-based approval.

Troubleshooting Steps

• Check Request Event Logs → confirm if the system receives the approval event.
• Review /var/log/fortipam/fortipam.log for parsing or SMTP/IMAP errors.
• Ensure FortiPAM is updated to v1.6.1 or later; older builds contain email approval bugs.
• Revalidate that the 'Approval Email Server' and 'Email Pulling Server' match your environment’s Exchange settings.

Gmail and 2FA Test Connection Failures

If testing with Gmail fails, it is due to Gmail’s OAuth 2.0 enforcement and removal of basic authentication. You can workaround this by:

• Using an App Password for Gmail accounts with 2FA enabled.
• Using an internal SMTP relay or Exchange relay to handle authentication securely.

Alternative Approval Methods (No Mail Server Needed)

If mail-based approval remains unfeasible:

1. Use FortiPAM web portal approvals directly through the Approvals dashboard.
2. Integrate FortiAuthenticator or FortiToken for push or token-based approvals.

These options eliminate the dependency on external mail flow while maintaining secure, auditable approval workflows.

Summary

Your specific issue occurs because Exchange causes FortiPAM’s reply parsing to fail when a new email is created instead of replying inline. Configure exclusive IMAP access for a dedicated service account, use App Passwords or relays if 2FA is enabled, and ensure the system is upgraded to a fixed release. If email cannot be reliably used, switch to portal- or token-based approvals for a stable workflow.