Connector preparation checklist

Who this page is for: the practice’s IT support. For Microsoft 365, an Owner records the exact mailbox and Refera can open a 10-minute administrator session when the production controller is enabled. The setup session expires; ongoing capture uses Refera’s certificate-backed application and exact mailbox scope. For other providers, Refera confirms the route before changes are made. No provider choice authorises live traffic.

The capture grant (one of three)

Practice email	The grant	Time
Microsoft 365	The exact existing shared or individual inbox that receives referrals + Exchange Application Mail.Read role limited by Application RBAC to that inbox; no parallel unscoped Entra Mail.Read grant	10-minute administrator session when the connection controller is enabled; target allowed, unrelated mailbox denied and a patient-free arrival verified before capture starts - steps
Own or hosted Exchange	Dedicated low-privilege IMAP service account (TLS, port 993, read-only in behaviour)	Assisted setup and a patient-free connection test before capture starts; the forwarding-address fallback is not yet available - steps
Gmail / Workspace	One-time read-only OAuth (gmail.readonly scope only)	Assisted setup and a patient-free connection test before capture starts; the forwarding-address fallback is not yet available - steps

For Microsoft 365, the capture grant above is read-only and does not authorise drafts or sending:

• Copy-ready reply text is prepared inside Refera and requires no Microsoft write permission.
• Creating a draft in Outlook is a separate opt-in mailbox-scoped Application Mail.ReadWrite grant. It creates a draft only and never sends.
• Sending is another separately approved and revocable mailbox-scoped Application Mail.Send grant. A named person approves every send; nothing sends automatically.

Do not grant either write permission merely to enable capture. Refera must show each as unavailable until that specific permission has been independently approved and verified.

Fax (recommended)

Do not port or redirect an existing fax number during self-serve signup. After the verified mailbox path and source-document controls pass, use a test number with fictional details for the connection check; an existing number moves only in a separately witnessed cutover. Australian providers include GoFax and Notifyre; terms and availability must be verified at purchase. Detail.

HealthLink (only if applicable)

Do not redirect an EDI mailbox or grant a watched-folder path from this checklist. HealthLink is not connected and remains gated on HealthLink’s written partner assessment, the applicable technical profile and conformance process, interface-specific synthetic testing, certificates, source lifecycle, live-network proof, monitoring and a reviewed reversible cutover. The practice’s existing delivery stays unchanged until a reviewed cutover. Detail.

Sign-on

Activated practices use passkeys today, with no password store. Microsoft 365 or Google SSO remains roadmap work and cannot weaken the WebAuthn floor. Detail.

What is never asked for

Refera does not ask for an EMR plug-in or EMR database access. Any future secure-messaging cutover follows its provider and delivery gates; a fallback address may require a separately planned referrer change. The full boundary is on Alongside your EMR.