How to securely use Azure App Registration to Send Emails on behalf of Shared Mailbox

Question

Hello,

We would like to implement automated email delivery from a cloud application written in python and deployed on AKS. we have the following elements in place:

• App Registration with "Delegation" type permissions to send emails.
• Service Principal credentials (client id + client secret)
• Shared Mailbox with permission granted already to the app registration.

The problem:

Situation 1: Access on Behalf of a User

• App Registration with "Delegation" type permissions to send emails.

https://learn.microsoft.com/en-us/graph/auth/auth-concepts#access-scenarios

User (logged in + access token) + Application ==> we are getting following error:

Failed to send email. Status code: 403, Error: {"error":{"code":"ErrorSendAsDenied","message":"The user account which was used to submit this request does not have the right to send mail on behalf of the specified sending account., Cannot submit message."}}

we don't want that we give the user access to shared mailbox. This is unacceptable high risk.

Situation 2: Access without User

• App Registration with "Application" type permissions to send emails.

It works when granting the "Application" type permissions, however, this means granting the application permissions to send emails on behalf of any user or on behalf of any shared mailbox in the organization, again unacceptable high risk.

What would the best approach to resolve this challenge ?

Answer 1

You can restrict application permissions to specific mailbox(es) only, as detailed for example here: https://learn.microsoft.com/en-us/Exchange/permissions-exo/application-rbac

Alternatively, you can use application access policies, though they will be deprecated at some point in the future, in favor of the solution above.