--- title: "Mail Application Test" slug: "mail-scout" updated: 2026-07-08T13:38:36Z published: 2026-07-08T13:38:36Z canonical: "support.controlup.com/mail-scout" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.controlup.com/llms.txt > Use this file to discover all available pages before exploring further. # Mail Application Scout Use the Mail Application Scout to test if your mail servers are working correctly. The Scout can alert you if a mail server is down or taking longer than expected to transmit emails. Currently, the Scout supports testing Microsoft Exchange Online mail servers. The Scout can perform two types of tests: - **Incoming mail**: The Scout sends an email from a Synthetic Monitoring server to your mail server, your mail server is accessed from the location (Hive) running the Scout to validate the email was received successfully. - **Outgoing mail**: The Scout sends an email to a recipient mail server (using their SMTP servers). Your mail server is accessed from the location (Hive) running the Scout to send the email, and the Synthetic Monitoring server validates that the email was received successfully. After both types of tests, the sent or received test email is deleted to save storage. To best monitor a mail server's performance, you should create two Scouts to test both incoming and outgoing emails. ### Prerequisites for creating a Mail Application Scout Before creating a Mail application Scout, make sure you've met the following prerequisites: 1. Created a **user** for the Scout (see "How to create a user for the Scout" below). 2. Obtained the **Admin's approval** for the app and its **required permissions** (appears as **ControlUp** in Azure). The Scout uses the ControlUp app to interact with the mail service, by fetching the customer’s access token and refresh token. Once we have these tokens, we trigger a process using these credentials to access the user’s email, through Microsoft Graph API. ### ControlUp's required permissions Here are the permissions that ControlUp requires, and the reasons we request them. | Required Permission | Description | Azure Permission | | --- | --- | --- | | Maintain access to data you have given it access to | Allows the app to see and update data you've given it access to, even when you are not currently using the app. This does not give the app any additional permissions. | `offline access` | | Sign in and read user profile | Grants the app permission to sign you in using your organizational account, and to read your user profile and basic company information. | `User.Read` | | Read and write access to user mail | Allows the app to read, update, create and delete email in your mailbox. Does not include permission to send email. | `Mail.ReadWrite` | | Send mail as a user | Allows the app to send mail as you (using your organizational account) | `Mail.Send` | > [!NOTE] > Note: > > If these prerequisites are not met, you will not be able to register the app and will be directed to the Admin for approval. ### How to create a user for the scout When you configure a Scout for either type of test, you must authenticate to your mail server with a user that has an authenticated mailbox. When setting up a user, note the following: - We recommend creating a dedicated user specifically for running this Scout. For optimal security, this user should be authorized exclusively for the mail service. - If you choose to create a user with access to multiple services, and your identity management system supports multiple mail services, ensure that the Exchange server tested by this Scout is set as the primary server. - To ensure the Mail Scout works properly, mark the **scoutbees.io** and **eu.scoutbees.io** domains as trusted in all email policies. Synthetic Monitoring emails may be flagged as spam due to their repetitive, templated nature, risking delivery issues. You can run the Scout from one of the preconfigured Cloud Hives locations, or you can [install a Custom Hive on-premises](https://www.google.com/search?q=https://www.controlup.com/install-a-custom-hive-on-premises) to run the Scout from a custom location. ### Create a Mail Application Scout 1. Click **Create Scout**. 2. Select the **Applications** tab and set the Scout **Type** to **Mail Application**. 3. Select the **Hives** to run the Scout. This is the location that accesses your mail server to either send or receive a test email, depending on the **Direction** you select in step 7. 4. In the **Mail Service** field, select the type of mail service to test. Currently, only Microsoft Exchange Online is supported. 5. Enter a **Name** for the Scout. 6. Select how often you want to test the resource using the **Run Every** slider. You can choose any interval from 5 to 60 minutes, in increments of 5 minutes (5, 10, 15, 20, and so on). 7. Set the **Direction.** Read above for details about each direction. 8. Click **Sign with Microsoft** and use an authorized **Entra ID** email address (this is the only IdP that we support for this scout). There are three possible scenarios when signing in. See the "[Sign in scenarios](/v1/docs/mail-scout#sign-in-scenarios)" section below. > [!NOTE] > Note: > > Temporary Access Pass (TAP) sign-in is not supported. 9. Optionally, add **Tags** to your Scout. Tags are key-value pairs which can be used to organize your Scouts. To learn more about tags, visit [Centralized Tags Management](/v1/docs/centralized-tags-management). 10. Click **Show additional parameters** if you want to change the **Timeout** duration. A test is considered a failure if the email is not successfully sent and received before the timeout duration has been reached. You can set the timeout duration between 5 seconds and 180 seconds. 11. Click **Next: Alert Policy** to set up alerts and notifications before saving the Scout. For more information, see [Alert Policies](https://www.google.com/search?q=https://www.controlup.com/alert-policies). ### Sign in scenarios When you try to sign in, you'll encounter one of the following screens. Note that the first two screens below appear only if you haven’t fulfilled the necessary prerequisites. - **Your organization doesn’t allow registration to third-party applications** In this case, a ‘**Need admin approval**’ screen is displayed, directing you to your administrator to approve the app. ![Need admin approval screen](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Need admin approval(1)(1).png) - **Your organization requires Admin consent for third-party applications** Attempting to register the ControlUp app with Microsoft Entra ID will display an "**Approval required**" screen. This screen will prompt your Admin for consent to the requested permissions. **Note**: you'll need to fill in your justification for requesting this app on the designated line. Once your Admin delivers your request, they need to follow the permissions and approve it. For details on why each permission is requested, they can see [ControlUp's required permissions](https://www.google.com/search?q=https://www.controlup.com/required-permissions) above. ![Approval required](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Approval required(1)(1).png) - **Your organization approves registration to third-party apps at the organization level** A **Permissions requested** screen is displayed with a list of the requested permissions, and all you need to do is **approve** them. For details on why each permission is requested, see [ControlUp's required permissions](https://www.google.com/search?q=https://www.controlup.com/required-permissions) above. ![Permissions requested screen](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Permissions requestd(1)(1).png) ### Approval by the Admin The Admin receives the consent requests by email (if so configured), and can approve them in one of the following ways: - **From the email:** clicking **‘Review Request’** will lead the Admin to the **Admin consent requests** page in **Enterprise Applications**. - **Direct approval in the Azure Portal:** Navigating to *Azure Active Directory > Enterprise Applications > Admin consent requests > My pending*. There the Admin can see the consent request for ControlUp and approve it. ![Enterprise screen](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/Updated Enterprise screen.png) ## Test Results Incoming and outgoing tests both record the total delivery duration of the mail, but incoming tests break it down into the total delivery duration across all hops and the server processing time. ### Test metrics The metrics in the table below are collected for each test result. | Metric name | Description | | | --- | --- | --- | | **Delivery Duration to Mail Server** (incoming mail) | The time it takes an email to pass all hops from the Synthetic Monitoring server until one hop before the last one (pre-last hop), which is your mail server. | | | **Server Processing Duration** (incoming mail) | The time it takes your mail server to process the email. | | | **Client to Server Duration** (outgoing mail) | The time it takes an email to pass from a client stimulated by the hive to your mail server. | | | **Server Processing Duration** (outgoing mail) | The time it takes your mail server to process the email. | | | **Server to Final Destination Duration** (outgoing mail) | The time it takes an email passing from your mail server to the final destination, which is the Synthetic Monitoring server. | | ### Test examples #### Incoming mail The screenshot below shows the Scout details page for an **incoming** test. The chart on the left shows the total mail delivery duration, while the chart on the right shows the duration for each phase in the process. ![test results - incoming mail](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/test%20results%20-%20incoming%20mail.png) Click on the results of an individual test to see more details. ![Test Details - incoming mail](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/IndividualTestresults%20-%20incoming.png) To see all of the hops, click **View more**. Hover over a hop for additional information. Note that the time for each hop is accurate only to the nearest whole second. ![AllHopsDetails - Incoming mail](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AllHopsDetails%20-%20incoming.png) #### **Outgoing mail** The screenshot below shows the Scout details page for an **outgoing** test. The chart on the left shows the total mail delivery duration, while the chart on the right shows the duration for each phase in the process. ![test results - outgoing mail](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/test%20results%20-%20outgoing%20mail.png) Click on an the results of an individual test to see more details. ![Test details - outgoing mail](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/IndividualTestresults%20-%20outgoing%281%29.png) To see all of the hops, click **View more**. Hover over a hop for additional information. Note that the time for each hop is accurate only to the nearest whole second. ![AllHopsDetails - Outgoing mail](https://cdn.document360.io/098100b7-b9da-4bea-b4b9-017140ab863e/Images/Documentation/AllHopsDetails%20-%20Outgoing.png)