FAQ & Troubleshooting¶

The email integration is an advanced add-on with many moving parts. Errors are logged in the Email Integration Logs page in Lime Admin. Always check the logs first!

Is SMTP Insecure? - Why Do We Need the SMTP.Send Permission?¶

The service Lime CRM uses to connect to the email server uses a modern SMTP authentication method called XOAUTH2, which works with OAuth 2.0 access tokens. This method ensures secure email sending through Transport Layer Security (TLS) and standard SSL encryption.

For more information regarding SMTP AUTH, see SMTP submission (SMTP AUTH) in Exchange Online.

Why Do We Need a User With Delegated Access to the Mailbox?¶

The email integration uses Microsoft's Delegated Permission model. This requires one user from the customer's domain, who has mailbox access, to consent to the email integration accessing the same mailbox. This user effectively grants permission for the email integration to access the mailbox, but they are not involved in sending or receiving emails.

It is important to note that this user does not have to be a Lime user; it just needs to be a Microsoft user with access to the shared mailbox. The customer can choose whether this user is a personal account or a service account, depending on what works best for them.

The credentials for this account do not need to be shared with Lime Technologies during the installation. A system administrator in Lime CRM can do the authentication themselves. Multi-Factor Authentication is supported.

We use this model because of our third-party service and its integration with OAuth and because it gives the customer more flexibility and control over which users have access to the mailbox.

For more information about permissions and consent, see: Microsoft Permissions and Consent Overview.

Mark as Read Action on Conversation Object Is Not Visible or Not Clickable¶

Ensure that the limepkg-standard-actions package is added as a dependency to your solution.

Why Do I Need to Have an Email Address on My Coworker When I Send an Email From Lime CRM?¶

Emails sent from Lime CRM are dispatched through the monitored account. However, when an email is sent from Lime CRM, one follower is created for you. Followers are uniquely identified based on the email address, so an email address must be available on your coworker for use on follower.

Is Object Access Supported for Text Snippets?¶

Yes! Text snippets are retrieved using Lime Query which in turn supports object access.

Merge Codes Are Not Populated Correctly¶

Verify all merge codes: Verify that the merge codes correspond to valid field names on the current limetype.
Confirm the starting position: The text snippet merge codes and the automatic reply merge codes begin on the conversation object, while the email signature merge codes begin on the coworker object.

User Is Authenticated but Not Connected¶

If you see the error "User is authenticated but not connected" when trying to add or use the account, this indicates a permission or configuration issue with the dedicated user's access to the shared mailbox.

Things to Verify¶

Full Access permissions: Verify that the dedicated user has Full Access permission to the shared mailbox. See Required Permissions for Shared Mailbox Access for instructions. Note that the Exchange Admin Center UI might be unreliable - if possible, verify permissions using PowerShell.
IMAP enabled: Verify that IMAP is enabled for both the dedicated user account and the shared mailbox. Without IMAP enabled on both accounts, the connection will fail.
Conditional Access policies: Conditional Access can allow OAuth login but still block IMAP connections. Check for policies that may interfere with IMAP access:
- "Require compliant device"
- "Block legacy protocols"
- "Require MFA"
- Location/IP restrictions
If IMAP is blocked by Conditional Access, the mailbox connection fails with this error. To resolve this, exclude both the dedicated user account and the shared mailbox from any Conditional Access policies that could block IMAP connections.

SendAsDenied Error When Sending Emails¶

If you encounter a "SendAsDenied" error when trying to send emails from Lime CRM, this indicates that the dedicated user does not have Send As permission on the shared mailbox.

Solution¶

See Required Permissions for Shared Mailbox Access for instructions on how to configure the necessary permissions.

Why Aren't Emails Being Imported with an IMAP Account and a Shared Mailbox?¶

The email integration does not support shared mailboxes for IMAP accounts. The monitored email address must be a user account with IMAP and SMTP credentials. If you add a shared mailbox as a monitored email address, the email integration will monitor the account of the authenticated user, not the shared mailbox.

Why Can't I Get Implicit TLS to Work with an Exchange On-Premise 2019 Server?¶

As far as we come to understand, Implicit TLS is not supported by Exchange On-Premise 2019. We recommend using STARTTLS instead, which can be configured in Lime Admin. For more information, read here.

Exchange Online Certificates¶

Exchange Online uses certificates issued by trusted Certificate Authorities (CAs), which are widely recognized and included in most operating systems' root certificate stores. If EmailEngine encounters certificate errors when connecting to Exchange Online, check for proxies or firewalls that may intercept traffic and replace the server's certificate with their own.

Troubleshooting Network Interception¶

If you suspect a proxy or firewall is intercepting traffic, inspect the certificate presented by Exchange Online using tools like openssl:

openssl s_client -connect outlook.office365.com:993 -showcerts
openssl s_client -connect smtp.office365.com:587 -showcerts

Confirm the certificate is issued by a trusted CA, such as "DigiCert". If the certificate is replaced by a proxy or firewall's certificate, see below:

Handling Certificate Errors¶

If EmailEngine encounters certificate validation errors:

If your proxy or firewall intercepts secure traffic, ensure it uses certificates from a trusted CA or disable interception.
Allow Insecure Certificates: As a last resort, you can allow insecure certificates for IMAP/SMTP by enabling the corresponding option in EmailEngine to bypass certificate validation. Caution: This is not recommended for production environments, as it reduces security! The setting can be found in the EmailEngine admin panel under Configuration > Service > Security Settings > Allow Insecure Certificates for IMAP/SMTP.

Emails With Plus Addressing Are Not Delivered¶

In some networks emails with plus addressing are blocked due to e.g. a spam filter or proxy / firewall in front of the email server hosting the monitored email account. This could either block every sender, or just senders from external email domains. The sender will receive an undeliverable email as shown below.

Plus addressing is one of three methods to identify existing conversations in Lime CRM. If this is blocked for you, we recommend to use another method instead.

Undeliverable email

Recipients Can Create Duplicate Conversations¶

When using Plus Addressing or Subject Line Identifier methods, recipients who reply to the original email (instead of the auto-reply) can trigger duplicate conversations.

Example:

John emails support@customer.com and CCs Lisa
Lime CRM creates a ticket and sends auto-replies to both John and Lisa
The auto-replies contain the conversation identifier (in the address or subject)
Lisa clicks "Reply All" on John's original email (which lacks the identifier)
Lime CRM cannot match Lisa's email to the existing conversation
Result: A new duplicate ticket is created, triggering another round of auto-replies

Why this happens:

The identifier only exists in emails that Lime CRM sends. When Lisa replies to John's original message, that email doesn't contain the identifier, so the system treats it as a brand new conversation.

Solution:

Use Message-ID Threading instead. This method uses invisible email headers that are properly maintained across the entire email thread, regardless of which message someone replies to. CC recipients can reply to any message in the thread without creating duplicates.

If you must use Plus Addressing or Subject Line Identifier:

Ask recipients to reply to the auto-reply emails (not the original message)
Be aware that CC recipients may create duplicate tickets
Manually merge duplicate conversations when they occur

Monitoring and Recovering Failed Email Imports¶

How to Monitor Failed Emails¶

Email Integration automatically imports most emails successfully, but some may fail due to configuration issues, size limits, or other problems. As an administrator, you should regularly monitor for failed imports.

Where to check:

Go to Lime Admin > Email Integration > Email Accounts
Look at the "Failed emails" column in the accounts table
A number greater than 0 indicates emails that couldn't be imported

What the number means:

The "Failed emails" counter shows how many emails are currently in the "Lime CRM Integration Failed" folder in the mailbox. These emails were moved there because the integration encountered an error during import (e.g., size limit exceeded, corrupted attachment, configuration problem).

How to Retry Failed Imports¶

When you see failed emails, follow these steps:

Step 1: Attempt Automatic Recovery

Click the checkbox next to the account with failed emails
Click the "Sync emails" button at the top
This triggers a manual recovery process that:
Retries all failed emails in the "Lime CRM Integration Failed" folder
Imports any unread emails in the inbox
Moves successfully imported emails to "Lime CRM Integration Processed"

Step 2: Check If Failures Persist

After the sync completes (usually within a few minutes):

Refresh the Email Accounts page
Check if the "Failed emails" number decreased
If the number is now 0, the recovery was successful
If the number remains the same or only decreased partially, continue to Step 3

Step 3: Investigate the Root Cause

If failures persist after sync, you need to investigate why the emails can't be imported:

Check the Email Integration Logs in Lime Admin: Email Integration > Logs
Look for "Import Failure" or "Manual Import Failure" entries
The log entries show which emails failed and why
Common error messages will indicate the cause (see troubleshooting below)

Common Causes and Solutions¶

1. Configuration Issues¶

Symptoms: Emails fail consistently for a specific account or configuration.

Solution: 1. Go to Lime Admin > Email Integration > Email Accounts 2. Review the account configuration for any errors 3. Check conversation parent settings and monitored account assignments 4. Update the configuration if needed 5. Click "Sync emails" to retry with the corrected configuration

2. Size Limitations¶

Symptoms: Large emails with attachments fail to import.

Solutions:

Option A: Remove attachments and retry (Recommended for individual cases)

Open your email client and go to the "Lime CRM Integration Failed" folder
Open the failed email
Remove the large attachment(s) or save them separately
Move the email (without attachments) back to the inbox
The email will be reimported automatically via webhook
Manually upload the attachments to the conversation in Lime CRM if needed

Option B: Increase size limit (For recurring issues)

Check the Email Integration Logs for "size limit exceeded" errors
The default size limit is 25 MB, set in the application configuration
Adjust the configuration to match your mail server's capabilities
Note: The limit should not exceed your mail server's maximum message size
Click "Sync emails" to retry with the new limit

Symptoms: Specific individual emails fail repeatedly even after configuration fixes.

Possible causes:

Corrupted attachments: The email contains damaged files that can't be processed
Unsupported formats: The email or attachments use formats the integration cannot handle
Malformed email structure: The email doesn't follow standard RFC specifications

Solutions:

Option A: Fix and retry (Recommended)

Access the failed email:
Open your email client (Outlook, Gmail, or similar)
Go to the "Lime CRM Integration Failed" folder
Open the problematic email
Review and fix the issue:
Check for corrupted or oversized attachments
If attachments are the problem, remove them
If the email format seems corrupted, you may need to recreate it
Move back to inbox for automatic retry:
Move the fixed email back to the Inbox folder
The email will be automatically imported via webhook
Check the conversation appears in Lime CRM
Upload any removed attachments manually to the conversation if needed

Option B: Manual entry (For unsolvable cases)

When an email cannot be fixed and reimported:

Create a new conversation in Lime CRM manually
Copy the email content into a new message
Upload any valid attachments directly
Add participants as followers
Delete the failed email from the "Lime CRM Integration Failed" folder

When to Contact Support¶

Contact your Lime support team if:

The same type of failure occurs repeatedly
The Email Integration Logs show errors you don't understand
Configuration changes don't resolve the failures
You need help adjusting size limits or other technical settings
Emails fail even after removing attachments and moving back to inbox

Email Loops¶

The email integration has automatic reply detection in place to protect against email loops. However, they can still happen.

Break the Loop¶

You need to temporarily pause the automatic replies from Lime CRM. This can be done by disabling the automatic reply feature in Lime Admin for the affected account. The next automatic reply from the customer will be imported without our own automatic reply, at which point the loop is broken. When you see that conversation in Lime CRM, you can re-enable automatic replies again.

Clean Up¶

The loop will have created duplicate conversations and conversation parents (e.g., tickets) in Lime CRM. You should delete all of these except for the first one. To do this:

Go to the table explorer (for conversations and/or conversation parents).
Filter by the subject.
Sort by date.
Delete all entries except the original.

Prevent Future Loops¶

Contact the person who caused the loop and make them aware of the missing headers in their automatic replies.

Resource Does Not Exist or One of Its Queried Reference-Objects Are Not Present¶

When using Microsoft Graph API as the base scope, this error may occur when adding a shared mailbox.

This error occurs because the User Principal Name (UPN) of the shared mailbox does not match the shared mailbox address you entered when adding the account in Lime Admin. These two values must match exactly.

The solution depends on where your organization manages user identities:

For Azure AD (Cloud-Only)¶

In Entra Admin Center, navigate to Users > All users
Find and select the shared mailbox
Check the User principal name field in the overview
Choose one of the following options:
- Option A: Reconnect the account in Lime Admin using the UPN as the shared mailbox address
- Option B: Update the UPN in Entra Admin Center to match your shared mailbox address, then reconnect the account in Lime Admin

For Local AD (On-Premise or Hybrid)¶

Open Active Directory Users and Computers on your domain controller
Locate the shared mailbox account
Right-click the account and select Properties
Navigate to the Account tab and check the User logon name (this is the UPN)
Choose one of the following options:
- Option A: Reconnect the account in Lime Admin using the UPN as the shared mailbox address
- Option B: Update the UPN in Active Directory to match your shared mailbox address, wait for Azure AD Connect to synchronize the changes (typically 30 minutes for hybrid environments), then reconnect the account in Lime Admin