1. App registration setup
To ensure a stable and low-maintenance connection, a dedicated service account in Microsoft Entra ID is recommended.
-
Permission type: Use Application Permissions instead of delegated permissions.
-
Required scope:
Mail.Send -
Advantage: Unlike delegated permissions, Application Permissions do not require a user to manually re-authenticate (interactive login). This prevents connection interruptions caused by expired tokens or password changes.
2. Mailbox configuration
We recommend using a shared mailbox in combination with a service user.
-
Cost savings: Shared mailboxes typically do not require a separate Exchange license (for sizes up to 50 GB).
-
Structure: The application authenticates using the service user but sends emails with the shared mailbox's address.
3. Security notice: access restriction
By default, the
Mail.Send
Application Permission of the app allows sending emails on behalf of any users within the organization.
Important security recommendation: If you want to restrict access to a specific mailbox, you must configure an Application Access Policy in Exchange Online. This ensures the app is technically only authorized to send from the defined addresses.