Microsoft Graph API setup for mail sending

Admin Credentials: You must have Global Administrator rights for your Microsoft 365 tenant.
Access to Microsoft Entra: You will need to view your tenant details at Microsoft Entra.
PowerShell on Your PC:
- Windows PowerShell or PowerShell Core.
- Install the ExchangeOnlineManagement module by running:
```
Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
```
Basic Knowledge: Familiarity with copying and pasting commands in PowerShell. Don’t worry if you are a beginner—the steps below are detailed and straightforward.

Construct the Admin Consent URL:
Use the following URL format. Replace <YOUR-DOMAIN-NAME> with your actual domain name (for example, if your domain is "contoso.com", use that):
```
https://login.microsoftonline.com/<YOUR-DOMAIN-NAME>/adminconsent?client_id=03126c25-5828-4b2e-aa6d-d97380cb1cb5&redirect_uri=https://eniris.io
```
Visit the URL:
Have your Microsoft 365 global admin log into their browser and navigate to the URL. They will see a consent dialog listing the permissions our app is requesting (for example, Mail.Send).
Grant Consent:
The admin should click "Accept" to grant consent. This action will create a service principal for our app in your tenant and allow it to send emails.
Notify Us:
After granting consent, please create a ticket eniris.io/support with the following details:

Open PowerShell:
Run PowerShell as an administrator on your PC.

Connect to Exchange Online:
Install the ExchangeOnlineManagement module (if not already installed) and then connect:

Install-Module -Name ExchangeOnlineManagement -Scope CurrentUser
Connect-ExchangeOnline -UserPrincipalName "<YOUR-ADMIN-EMAIL>"  # For example: admin@yourdomain.com

Create the Application Access Policy:
Run the following command. Replace <YOUR-SECURITY-GROUP-EMAIL> with the actual email address or Object ID of your security group:

New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "03126c25-5828-4b2e-aa6d-d97380cb1cb5" -PolicyScopeGroupId "<YOUR-SECURITY-GROUP-EMAIL>" -Description "Restrict app access to the noreply mailbox only"

Verify the Policy:
Test that the policy works by running (replace with your actual noreply email address):

Test-ApplicationAccessPolicy -Identity "<YOUR-NOREPLY-EMAIL>" -AppId "03126c25-5828-4b2e-aa6d-d97380cb1cb5"

Disclaimer

Table of Contents

Overview

On this page

Prerequisites

Step 2: Capturing Your Tenant Details

Step 3: Configuring Access Restrictions

Creating the Required Mail Security Group

Applying Access Restrictions

Security Considerations

Additional Information & Resources

Common Issues:

PowerShell Errors:

Policy Verification: