FortiPAM : Email Approval Template and Email settings issues

[henry63]

I am facing issue in FortiPAM email approval workflow. We don't have any mail server in our organization. We use Microsoft Mail Exchange Server for mail service. Let's say, there are user1(approver), user2(requester) and user3. If user2(requester) request a secret, a mail sent to approver inbox. If approver click "approve button", it created new mail. but it doesn't any approve at requester end. 
We also cannot use email test connection to gmail account for 2FA purpose. 

[Jean-Philippe_P]

Hello henry63, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

[Jean-Philippe_P]

Hello again henry63,

I found this solution. Can you tell us if it helps, please?

FortiPAM Email Approval Workflow with Microsoft Exchange

When FortiPAM is configured to send and process approval emails, it relies on SMTP for sending messages and IMAP or POP3 for retrieving reply emails. Since your organization uses Microsoft Exchange Server instead of an internal mail relay, the issue arises when FortiPAM cannot fully process the approval because Exchange restricts how reply messages are composed or authenticated.

Typical Cause of the Problem:

• The 'Approve' button creates a new email instead of an inline reply, so FortiPAM cannot match the approval token with the original request.
• The service account under which FortiPAM connects to Exchange may not have the necessary IMAP access or the mailbox may not be configured for programmatic access.
• If multiple FortiPAM instances use the same mailbox, only one system can retrieve and process reply messages correctly.

Recommended Configuration for Microsoft Exchange Integration

1. Enable IMAP Access:
   Ensure that IMAP is enabled for the FortiPAM service account in Exchange (can be configured via Microsoft 365 Admin Center or Exchange Admin Shell).
2. SMTP/IMAP Settings:

• SMTP Server: smtp.office365.com, Port 587 (STARTTLS).
• IMAP Server: outlook.office365.com, Port 993 (SSL/TLS).
• Authentication: Use user principal name (e.g., fortipam@domain.com) and an App Password if MFA is enforced.

3. Dedicated Mailbox:
   Assign one exclusive mailbox to FortiPAM. Do not share it with other applications.
4. Workaround for Reply Issue:
   Advise approvers to use the reply action in the same message thread instead of clicking “New Email” when approving. Alternatively, enable portal-based approval.

Troubleshooting Steps

• Check Request Event Logs → confirm if the system receives the approval event.
• Review /var/log/fortipam/fortipam.log for parsing or SMTP/IMAP errors.
• Ensure FortiPAM is updated to v1.6.1 or later; older builds contain email approval bugs.
• Revalidate that the 'Approval Email Server' and 'Email Pulling Server' match your environment’s Exchange settings.

Gmail and 2FA Test Connection Failures

If testing with Gmail fails, it is due to Gmail’s OAuth 2.0 enforcement and removal of basic authentication. You can workaround this by:

• Using an App Password for Gmail accounts with 2FA enabled.
• Using an internal SMTP relay or Exchange relay to handle authentication securely.

Alternative Approval Methods (No Mail Server Needed)

If mail-based approval remains unfeasible:

1. Use FortiPAM web portal approvals directly through the Approvals dashboard.
2. Integrate FortiAuthenticator or FortiToken for push or token-based approvals.

These options eliminate the dependency on external mail flow while maintaining secure, auditable approval workflows.

Summary

Your specific issue occurs because Exchange causes FortiPAM’s reply parsing to fail when a new email is created instead of replying inline. Configure exclusive IMAP access for a dedicated service account, use App Passwords or relays if 2FA is enabled, and ensure the system is upgraded to a fixed release. If email cannot be reliably used, switch to portal- or token-based approvals for a stable workflow.

[henry63]

Hello Jean-Philippe_P, 

Thank you very much for your solutions, I will test it and get back to you soon. What about there is a concern that enabling IMAP on Microsoft Exchange server. Do we have alternative way? Customer doesn't want to enable IMAP on Microsoft Exchange Server, cause they don't want to sync data to cloud. 

Please understand me for my typo.

Best Regards,
Henry

[Jean-Philippe_P]

Hello Henry :) 

I found this answer, does it help you?

FortiPAM’s email approval workflow is dependent on IMAP access to retrieve approval responses from a mailbox. When IMAP cannot be enabled on Microsoft Exchange due to security or compliance restrictions (such as avoiding cloud data synchronization), there are alternative solutions:

1. Use FortiPAM Web Portal for Approvals

Approvers can log in to the FortiPAM web interface and approve or deny requests directly from the Request Events → Request Event Log page. This method fully bypasses Exchange or IMAP connectivity while maintaining full auditability within FortiPAM.

2. Use FortiMail or Other SMTP Relay for Notifications

FortiPAM can send outbound notification and approval request emails through a secure SMTP relay like FortiMail. This ensures delivery of email notifications while relying only on SMTP (not IMAP). To set this up:

• Configure FortiMail as the SMTP relay in System → Email Settings.
• Permit the FortiPAM appliance to connect to the FortiMail SMTP port.
• Test the configuration using the built-in Test Connection option.

3. Implement REST API-Based Approvals

For automation and integration purposes, FortiPAM provides REST API endpoints that allow programmatic approval or denial of requests without any email workflow. API users can be created with restricted roles for security, enabling integration with ticketing systems, custom approval dashboards, or third-party workflow platforms.

4. Consider Webhook or Automation Workflows

Although primarily used in FortiGate, Fortinet’s automation fabric supports webhook-triggered workflows that can extend to FortiPAM environments. This enables triggering actions or notifications via REST calls rather than relying on email.

Summary

If enabling IMAP on Microsoft Exchange poses data residency or compliance issues, the recommended approach is to:

• Send notifications via FortiMail or another SMTP relay.
• Use the FortiPAM web portal or REST API for approvals. These methods avoid any need for IMAP or cloud mailbox access while maintaining functionality and compliance.

[henry63]

Hello Jean-Philippe_P, 

Could you kindly explain me about Gmail and 2FA Test connection failures case in details. Is there any reference docs or guide? I would like to get to study and refer.

Thank you very much for your strong support. 

Best Regards,

Henry