3-step handoff: stage the Azure AD app reg, grant admin consent, then verify the workspace connection. v1 walks-through only — the OAuth start endpoint returns 501 until the live wire-up lands.
Once the live callback lands, this step will show the stored token's expiry, the signed-in workspace UPN, and a "send test notice" button that round-trips a real Graph sendMail call. Today it surfaces the stubbed state so you can see the wiring.
In the meantime, notices still route end-to-end via email_outbox. Visit the email integration page to see queue state.