Sending email with service account from Azure automation using Graph

Question

Hello, Is it possible to send emails with a Service Account from Azure Runbooks without using "application permissions"? For instance, if I create an Azure AD application and assign API permissions to it as following

Then I create a Service Account (e.g., ******@company.com) and add it to the "Users and groups" blade for the application. Should I be able to send emails automatically with Azure Runbooks using only the Service Account's name?

Answer 1

Sure, it's possible, but how do you plan to authenticate? Unless you want to use the insecure ROPC flow, authentication will need to be interactive, i.e. someone will have to type the credentials, or approve a request.

For this reason, the usual approach is to authenticate as an app, or leverage an Azure managed identity. If you are worried about the permissions needed for such approach and their scope, you can configure additional controls on Exchange Online side to restrict access to just a given account/mailbox. Here's a sample article that details the process: https://janbakker.tech/a-love-story-about-role-based-access-control-for-applications-in-exchange-online-managed-identities-entra-id-admin-units-and-graph-api/