Migration guide

Delegated versus application Mail.Send permissions

Choose the Microsoft Graph permission model that matches who or what sends mail.

Delegated permission acts with a user

A user signs in and consents, subject to tenant policy. Calls such as `/me/sendMail` act as that signed-in user. smtpify365 uses delegated Mail.Send and does not request tenant-wide application Mail.Send.

Application permission acts without a signed-in user

Application Mail.Send is designed for daemon or service scenarios and requires administrator consent. Its potential reach and operational controls differ materially from delegated access.

Match the model to the system

Use direct Graph with the appropriate permission model when developing a maintained application. A mailbox-specific delegated bridge fits a different problem: a user connects one mailbox for an SMTP-only client.

Primary sources

Microsoft Learn: Basic authentication deprecation in Exchange Online ↗Microsoft Learn: Set up devices and applications to send using Microsoft 365 ↗Microsoft Learn: Microsoft Graph user sendMail ↗