diff --git a/src/core/DigitalData.MessagingService.Domain/Entities/EmailAccount.cs b/src/core/DigitalData.MessagingService.Domain/Entities/EmailAccount.cs
index 691229e..b7e88b3 100644
--- a/src/core/DigitalData.MessagingService.Domain/Entities/EmailAccount.cs
+++ b/src/core/DigitalData.MessagingService.Domain/Entities/EmailAccount.cs
@@ -103,18 +103,38 @@ public class EmailAccount
 
     /// <summary>
     /// OAuth2 client secret (required when <see cref="UseOAuth2"/> is true).
+    /// For Microsoft: the app registration client secret value from Azure Portal.
+    /// For Google: the client secret from Google Cloud Console credentials JSON.
     /// </summary>
     [MaxLength(512)]
     [Column("OAUTH2_CLIENT_SECRET", TypeName = "nvarchar(512)")]
     public string? OAuth2ClientSecret { get; set; }
 
+    /// <summary>
+    /// OAuth2 refresh token (Google only).
+    /// Obtained once via the OAuth2 authorization flow (e.g. OAuth Playground).
+    /// Used to exchange for short-lived access tokens without user interaction.
+    /// Leave empty for Microsoft — MSAL handles token refresh internally.
+    /// </summary>
+    [MaxLength(1024)]
+    [Column("OAUTH2_REFRESH_TOKEN", TypeName = "nvarchar(1024)")]
+    public string? OAuth2RefreshToken { get; set; }
+
     /// <summary>
     /// OAuth2 tenant ID (e.g. for Microsoft 365: tenant GUID or "common").
+    /// Not required for Google — leave empty.
     /// </summary>
     [MaxLength(256)]
     [Column("OAUTH2_TENANT_ID", TypeName = "nvarchar(256)")]
     public string? OAuth2TenantId { get; set; }
 
+    /// <summary>
+    /// Identifies which OAuth2 identity provider to use when <see cref="UseOAuth2"/> is true.
+    /// Determines which token acquisition strategy is applied.
+    /// </summary>
+    [Column("OAUTH2_PROVIDER", TypeName = "int")]
+    public OAuth2Provider OAuth2Provider { get; set; } = OAuth2Provider.None;
+
     /// <summary>
     /// The protocol used to receive (sync) incoming emails.
     /// When set to <see cref="IncomingProtocol.None"/>, this account is send-only and will be skipped by the sync worker.
diff --git a/src/core/DigitalData.MessagingService.Domain/Enums/OAuth2Provider.cs b/src/core/DigitalData.MessagingService.Domain/Enums/OAuth2Provider.cs
new file mode 100644
index 0000000..6d0f121
--- /dev/null
+++ b/src/core/DigitalData.MessagingService.Domain/Enums/OAuth2Provider.cs
@@ -0,0 +1,29 @@
+namespace DigitalData.MessagingService.Domain.Enums;
+
+/// <summary>
+/// Identifies the OAuth2 identity provider used to acquire access tokens.
+/// Only relevant when <c>UseOAuth2 = true</c>.
+/// </summary>
+public enum OAuth2Provider
+{
+    /// <summary>
+    /// No OAuth2 provider — account uses plain username/password authentication.
+    /// </summary>
+    None = 0,
+
+    /// <summary>
+    /// Microsoft identity platform (Azure AD / Microsoft 365 / Exchange Online).
+    /// Uses MSAL with the client credentials flow against
+    /// <c>https://login.microsoftonline.com/{tenant}</c>.
+    /// Requires <c>OAuth2ClientId</c>, <c>OAuth2ClientSecret</c> and <c>OAuth2TenantId</c>.
+    /// </summary>
+    Microsoft = 1,
+
+    /// <summary>
+    /// Google identity platform (Gmail / Google Workspace).
+    /// Uses the service-account or OAuth2 client credentials flow against
+    /// <c>https://oauth2.googleapis.com/token</c>.
+    /// Requires <c>OAuth2ClientId</c> and <c>OAuth2ClientSecret</c>.
+    /// </summary>
+    Google = 2,
+}