How to send an email on behalf of distribution group?

Question

A distribution group email address is a virtual email address used for delivering emails to the entire group of specific users. I'd like to use it for the "From" field, so the recipient could simply reply and all group members would receive the response. We do this regularly in Outlook and I'd like to automate this via API.

While Copilot insists it is possible, our IT admins deny this claim (To send emails using Microsoft Graph, the mailbox needs to be licensed. Unlicensed mailboxes, such as those without an Office 365 or Exchange Online subscription, cannot use the sendMail functionality). My idea was to create a client App with client_credentials authentication and Mail.Send permissions.

Can anybody confirm there is really no way to achieve this using MS Graph API?

Answer 1

Hi @Jan Tošovský,

Welcome to the Microsoft Q&A platform!

I think your idea works. Microsoft Graph permissions and Mailbox permissions are enough, Mail.Send.Shared permission ensures the permission to send the message, on behalf of the sender and the proxy sender determines the result of the sender.

https://learn.microsoft.com/en-us/graph/outlook-send-mail-from-other-user#permissions

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Hi @Anonymous

I can confirm my client App can send emails on behalf of shared mailboxes or regular users (specified as direct members of the app).

But I am unable to send emails on behalf of the distribution group:
{"error":{"code":"ErrorInvalidUser","message":"The requested user '******@server.com' is invalid."}}

Our admins tried to assign special permissions to this group address using App ID as Trustee:

Get-RecipientPermission -Identity "******@server.com" -Trustee "d45b628c-67c8-4df7-9ef4-e2f2cf8453cf" -AccessRights SendAs 

but this fails: "User or group "d45b628c-67c8-4df7-9ef4-e2f2cf8453cf" wasn't found.

Btw, Mail.Send.Shared permission is only available for delegated authentication whereas I need application permission because the app will run as a daemon.