What are the minimal RBAC permissions required to send email using Azure Communication Services EmailClient?

Hi Craig,

I have had this exact problem. I ended up creating a custom role with the following permissions for this purpose. It works well.

"permissions": [
	{
		"actions": [
			"Microsoft.Communication/CommunicationServices/Read",
			"Microsoft.Communication/EmailServices/read",
			"Microsoft.Communication/EmailServices/write",
			"Microsoft.Communication/EmailServices/Domains/read",
			"Microsoft.Communication/EmailServices/Domains/SenderUsernames/read",
			"Microsoft.Communication/EmailServices/Domains/SuppressionLists/read",
			"Microsoft.Communication/EmailServices/Domains/SuppressionLists/SuppressionListAddresses/read",
			"Microsoft.Communication/Operations/read",
			"Microsoft.Communication/CommunicationServices/Write",
			"Microsoft.Communication/RegisteredSubscriptions/read"	
		],
		"notActions": [],
		"dataActions": [],
		"notDataActions": []
	}
]

Hi @Craig Wallace
To send emails with Azure Communication Services EmailClient, ensure your custom role includes these minimum RBAC permissions:

To get started, you'll need the following permissions related to Microsoft.Communication:

Read Email Services: Microsoft.Communication/EmailServices/read

Create or Update Email Services: Microsoft.Communication/EmailServices/write

Manage Domains: You will need permissions to manage the email domains you're using:

• Microsoft.Communication/EmailServices/Domains/read
• Microsoft.Communication/EmailServices/Domains/write
• Microsoft.Communication/EmailServices/Domains/delete

Additionally, you may want to include specific actions related to SenderUsernames if you intend on managing sender credentials:

• Microsoft.Communication/EmailServices/Domains/SenderUsernames/read
• Microsoft.Communication/EmailServices/Domains/SenderUsernames/write

These permissions are sufficient for sending emails, without the broader access given by the 'Communication and Email Service Owner' role.

For more details, see:

• Azure permissions for Integration
• Create credentials for Simple Mail Transfer Protocol (SMTP) authentication
  Let me know if you have any further assistances needed.