Setting up Microsoft Entra to use an Exchange account to send email notifications

Registering the Confidencial app in Microsoft Entra

1. Create a new or select an existing M365 account from which you want Confidencial to send email notifications

2. Log in to the Microsoft Entra admin center

3. Expand the Identity menu > expand Applications> select App registrations > New registration

4. Enter the following values:
1. Name: Confidencial
2. Supported account types: Accounts in this organizational directory only
3. Redirect URI (optional): Leave blank

5. Click Register

6. Select Certificates & secrets > Certificates > Upload certificate

7. Upload the certificate that is provided by Confidencial

8. Click Add

9. Click Overview and make note of the application’s (client) ID. This ID will be used later when restricting application permissions.

Creating a mail-enabled security group

1. In the Exchange Admin Center, click Recipients > Groups > Mail-enabled security

2. Click Add a group, select Mail-enabled security, and click Next

3. Enter the following values:
1. Name: Confidencial notifications
2. Description: Mailboxes used to send notifications on behalf of the Confidencial app

4. Click Next

5. Assign owners to the group - these are users that have the ability to manage group settings

6. Click Next

7. Add the member that owns the mailbox to be used for Confidencial notifications

8. Click Next

9. For Group email address, enter confidencial (@yourdomain.com)
1. Leave the Communication checkbox unchecked
2. Check the Approval checkbox to limit membership to the group

10. Click Next

11. Click Create group, then click Close

Restricting Confidencial app access to a single mailbox

1. Connect to Exchange Online PowerShell. For details, see Connect to Exchange Online PowerShell.

2. Create an application access policy by executing the command below in Exchange Online PowerShell. Replace app-id with the application (client) ID noted in the first section above. Replace yourdomain.com with your domain.
⚠️
NOTE: It is likely you will need to execute commands to allow for script execution. See here for details.

New-ApplicationAccessPolicy -AppId app-id -PolicyScopeGroupId confidencial@yourdomain.com -AccessRight RestrictAccess -Description "Restrict this app to members of distribution group confidencial@yourdomain.com"

3. Test the access policy with the command below. Replace yourmailbox@yourdomain.com with the email address of the mailbox to be used for Confidencial notifications (note that this is different from the group email address you specified in the previous step). Replace app-id with the application (client) ID noted in the first section above. Repeat this command using an email address that is NOT the one to be used to send Confidencial notifications.

Test-ApplicationAccessPolicy -Identity yourmailbox@yourdomain.com -AppId app-id

If the access policy is correct, the output of the above command should include AccessCheckResult : Granted. If you run the above command with an email address that is NOT in the security group, you should see AccessCheckResult : Denied.
⚠️
NOTE: Changes to application access policies can take longer than one hour to take effect in Microsoft Graph REST API calls, even when Test-ApplicationAccessPolicy shows positive results. If there is concern about exposing unnecessary access to Graph API calls, it is recommended to wait at least one hour before proceeding to the next section.

Setting Confidencial app permissions in Entra

1. Log in to the Microsoft Entra admin center

2. Expand the Identity menu > expand Applications > select App registrations

3. Select the Confidencial app registration that you created in the first section. You may need to click the All applications tab for this application to appear in the list.

4. Under Manage, click API permissions, then click Add a permission

5. Click Microsoft Graph

6. Select Application permissions

7. In the Select Permissions search box, enter Mail.Send

8. Expand the Mail result that appears, click the checkbox next to Mail.Send, then click Add Permissions

9. Click Grant admin consent for… and click Yes on the resulting confirmation dialog