Grant access to send emails through Microsoft 365

Fortytwo Universe allows you to use your own email addresses in Microsoft 365 as sender addresses for emails. This means that your users see a sender like noreply@contoso.com, which is a known domain, and you will have no issues with spam filters blocking the email.

There are a few steps required to grant Fortytwo Universe access to send emails. They are done once per mailbox.

The permission is given in Exchange Online, for the mailboxes you choose, with Role Based Access Control for Applications. Fortytwo Universe does not ask for the Microsoft Graph permission Mail.Send in Microsoft Entra ID, because that permission lets an application send as anyone in your organization.

Before you start

You need:

• a Global administrator or Privileged role administrator, to consent to the application;
• an Exchange administrator, who is a member of the Organization Management role group, for the steps in Exchange Online;
• the Exchange Online PowerShell module;
• the address of each mailbox Fortytwo Universe may send from.

Grant the access

Consent to the application

If you have not already done so, consent to the Fortytwo Universe - Workflows application:

https://login.microsoftonline.com/common/adminconsent?client_id=a215ca40-216b-49aa-ac23-f5256a8d6555

The application now appears under Enterprise applications in the Microsoft Entra admin center.

Find the application's object ID

In the Microsoft Entra admin center, open Enterprise applications and select Fortytwo Universe - Workflows. Copy its Object ID. The Application ID is a215ca40-216b-49aa-ac23-f5256a8d6555.

Note

Use the object ID from Enterprise applications. The one under App registrations is a different value and does not work.

Connect to Exchange Online

PowerShell

Connect-ExchangeOnline

Tell Exchange Online about the application

Replace the object ID with the one you copied:

PowerShell

New-ServicePrincipal -AppId "a215ca40-216b-49aa-ac23-f5256a8d6555" -ObjectId "OBJECT_ID_OF_FORTYTWO_UNIVERSE_WORKFLOWS_APP" -DisplayName "Fortytwo Universe - Workflows"

Say which mailboxes it may send from

Create a management scope that covers only the mailboxes Fortytwo Universe is allowed to send from. Replace the address with your sender address:

PowerShell

New-ManagementScope -Name "Fortytwo-Universe-MailSend-Scope" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'noreply@contoso.com'"

For several mailboxes, join the addresses with -or:

PowerShell

New-ManagementScope -Name "Fortytwo-Universe-MailSend-Scope" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'noreply@contoso.com' -or PrimarySmtpAddress -eq 'servicedesk@contoso.com'"

Give the permission for those mailboxes

PowerShell

New-ManagementRoleAssignment -App "OBJECT_ID_OF_FORTYTWO_UNIVERSE_WORKFLOWS_APP" -Role "Application Mail.Send" -CustomResourceScope "Fortytwo-Universe-MailSend-Scope"

Check it

Test a mailbox that is allowed and one that is not:

PowerShell

Test-ServicePrincipalAuthorization -Identity "OBJECT_ID_OF_FORTYTWO_UNIVERSE_WORKFLOWS_APP" -Resource "noreply@contoso.com" | Format-Table
Test-ServicePrincipalAuthorization -Identity "OBJECT_ID_OF_FORTYTWO_UNIVERSE_WORKFLOWS_APP" -Resource "someone.else@contoso.com" | Format-Table

InScope is True for the mailbox you allowed and False for any other.

You can now use the mailbox as Send from in a workflow's Send email action. See Email.

Add or remove a mailbox later

Change the management scope. The role assignment keeps pointing at it:

Set-ManagementScope -Identity "Fortytwo-Universe-MailSend-Scope" -RecipientRestrictionFilter "PrimarySmtpAddress -eq 'noreply@contoso.com' -or PrimarySmtpAddress -eq 'hr@contoso.com'"

Take the permission away

Remove the role assignment. Fortytwo Universe can then send from no mailbox:

Get-ManagementRoleAssignment -Role "Application Mail.Send" | Where-Object { $_.CustomResourceScope -eq "Fortytwo-Universe-MailSend-Scope" } | Remove-ManagementRoleAssignment

If Mail.Send was granted in Microsoft Entra ID

An earlier version of this page asked you to grant the Microsoft Graph permission Mail.Send to the application in Microsoft Entra ID before limiting it in Exchange Online. Microsoft documents that the two add up: a permission granted in Microsoft Entra ID applies to every mailbox, and a scope in Exchange Online does not narrow it.

If you followed those steps, remove the permission in Microsoft Entra ID once the role assignment above is in place:

1. In the Microsoft Entra admin center, open Enterprise applications > Fortytwo Universe - Workflows > Permissions.
2. If Mail.Send is listed under Microsoft Graph, select Review permissions and follow the instructions to revoke it, or remove it with Microsoft Graph PowerShell:

Connect-MgGraph -Scopes "AppRoleAssignment.ReadWrite.All", "Application.Read.All"

$application = Get-MgServicePrincipal -Filter "appId eq 'a215ca40-216b-49aa-ac23-f5256a8d6555'"
$graph = Get-MgServicePrincipal -Filter "appId eq '00000003-0000-0000-c000-000000000000'"
$mailSend = $graph.AppRoles | Where-Object { $_.Value -eq "Mail.Send" }

Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $application.Id |
    Where-Object { $_.AppRoleId -eq $mailSend.Id } |
    ForEach-Object { Remove-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $application.Id -AppRoleAssignmentId $_.Id }

Then run the check under Grant the access again. Sending keeps working for the mailboxes in the scope.