Every mailbox on your domain,
in one approval.
Connecting mailboxes one at a time is what actually stops teams from warming up. Forty mailboxes means forty app passwords and forty things to redo the next time someone rotates a password. Bulk Connect replaces all of it with a single approval from your domain administrator.
Start free - no credit cardWhy connecting one at a time does not scale
A warmup tool needs permission to send from a mailbox and to read it, so delivery can be confirmed and replies sent. Granted per mailbox, that is an app password or an OAuth screen each. Fine for one mailbox. At fifty it is a project with an ongoing cost:
- App passwords expire and get revoked - and warmup stops silently for those mailboxes.
- Every new hire is a new setup task - a mailbox created today is not warming until someone connects it.
- Credentials have to live somewhere - fifty app passwords is fifty secrets to rotate if anything goes wrong.
- Many admins block it outright - plenty of Workspace and Microsoft 365 tenants disable app passwords as a security baseline, which makes per-mailbox IMAP connection impossible before you start.
Google Workspace: Domain-Wide Delegation
Google’s own mechanism for exactly this. A Super Admin registers MailPilot’s client ID against a specific scope list. The grant is bounded by those scopes - anything outside the list fails at the API - and is revocable from the same screen at any time.
Google Admin console -> Security -> Access and data control -> API controls -> Manage Domain-wide Delegation.
Paste MailPilot's client ID and the exact scope list shown in the app. Nothing outside those scopes can be accessed.
Back in MailPilot the domain's mailboxes are listed. Tick the ones you want warming and import them in one pass.
Microsoft 365: one admin consent, no PowerShell
Most guides for connecting Microsoft 365 to a third-party mail tool open with a block of Exchange Online PowerShell. For connecting a tenant, none of it is necessary.
Open the consent link from MailPilot and sign in. No app registration, client secret or certificate needed on your side.
Microsoft shows exactly which permissions are granted. One click. No PowerShell at any point.
You land back in MailPilot with the tenant connected. Choose which mailboxes to warm - the rest are left alone.
One thing to know before approving. Microsoft grants application permissions across the entire tenant - the consent screen covers every mailbox and cannot be narrowed there. That is how Microsoft Graph application permissions work, not a choice we make. We only ever touch the mailboxes you import. To restrict the grant itself, Microsoft provides Application Access Policy, which scopes the app to a mail-enabled security group.
Bulk connect vs. one at a time
| One at a time | Bulk connect | |
|---|---|---|
| Setup for 40 mailboxes | 40 passwords or consent screens | One admin approval |
| App passwords needed | One per mailbox | None |
| If the org disables app passwords | Blocked entirely | Works |
| Adding a new hire's mailbox | Full setup again | Already available to import |
| If a password is rotated | Warmup breaks silently | Unaffected |
| Who has to be involved | Every mailbox owner | One administrator, once |
Questions
Do I need app passwords for each mailbox?
No. With Domain-Wide Delegation or Entra admin consent, authorisation happens once at the domain level, so there are no per-mailbox app passwords to generate, store, rotate or lose. This also removes the most common cause of warmup breaking silently: a password being rotated or app passwords being cleared org-wide.
Does Microsoft admin consent give access to every mailbox?
Microsoft's application permissions are tenant-wide by design and the consent screen cannot be narrowed - that is how Microsoft Graph application permissions work, not a setting MailPilot chose. MailPilot only ever reads or sends from the mailboxes you explicitly import. If you want the grant itself narrowed, Microsoft's Application Access Policy lets your admin restrict the app to a specific mail-enabled security group.
Do I need PowerShell to connect Microsoft 365?
No. Connecting a tenant is a browser flow: a Global Administrator opens the consent link, reviews the permissions and clicks Accept. There is no PowerShell step, no app registration and no certificate upload. Application Access Policy, if you choose to use it, is done in Exchange Online PowerShell by your admin - but it is optional and not required to start.
How many mailboxes can I connect at once?
There is no per-connection limit on the import - a tenant with 200 mailboxes imports in one pass. What limits you in practice is your plan's mailbox allowance and your provider's own outbound sending limits, which apply per mailbox regardless of how many you connect.
Can one domain be connected to two MailPilot accounts?
No. A domain or tenant can be connected under one account at a time. Admin consent on both Google and Microsoft carries no per-caller binding, so without this restriction someone could authorise a domain another account already manages.
What happens if the admin revokes the grant?
Warmup for those mailboxes stops and the connection is flagged as needing reconnection rather than failing silently. MailPilot verifies a grant works before saving it and re-verifies on an ongoing basis, so a revoked grant surfaces as a clear status rather than mailboxes that quietly stopped sending.
No credit card. See also integrations and the full FAQ.