How to authenticate Email Communication Service with service principal with secret?

Question

How to authenticate Email Communication Service with service principal with secret?

Nicholas 25

I have an email communication service that I'm trying to authenticate with

credential = DefaultAzureCredential()

It works in local development but not in production, throwing an error:

DefaultAzureCredential failed to retrieve a token from the included credentials.

I then define AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET and AZURE_AUTHORITY_HOST

I still get this error:

(Denied) Denied by the resource provider.

Code: Denied

Message: Denied by the resource provider.

Bhargavi Naragani 7,940 Reputation points Moderator

2025-05-15T08:24:23.5233333+00:00
Hi @Nicholas,

It seems like you're trying to use a service principal with a secret to authenticate your Azure Communication Services (ACS) Email client in production. While it works fine in your local setup, you're seeing the error "(Denied) Denied by the resource provider" in production. This means the authentication is working, but the service principal doesn't have the right permissions to access the ACS Email service.

To fix this, you'll need to give the service principal the right Azure Role-Based Access Control (RBAC) role so it can properly access and use the ACS Email resource.

Navigate to the Azure Portal: https://portal.azure.comGo to Resource Groups or All Resources. Select your Azure Communication Services resource. In the left-hand menu, click on Access control (IAM) then Click on + Add => Add role assignment.

Choose a role that provides the necessary permissions. For ACS Email, suitable roles include:

Contributor: Grants full access to manage all resources, excluding the ability to assign roles.

Owner: Grants full access, including the ability to assign roles.

Custom Role: If you prefer more granular control, create a custom role with specific permissions like Microsoft.Communication/EmailServices/Send/action.

In the Members tab, select User, group, or service principal. Search for your service principal by name and select it. Review your selections and click Review + assign. Allow a few minutes for the role assignment to propagate.

What is Azure role-based access control (Azure RBAC)?
Assign Azure roles using the Azure portal
Azure built-in roles - Azure RBAC
Authenticate to Azure Communication Services
Azure permissions - Azure RBAC

Hope the above provided information help you resolve the issue, if you have any further concerns or queries, please feel free to reach out to us.
Nicholas 25 Reputation points

2025-05-15T09:06:03.3933333+00:00

I've done this, I've added my App Service as Communication and Email Service Owner
Laxman Reddy Revuri 5,475 Reputation points Microsoft External Staff Moderator

2025-05-15T10:04:16.61+00:00

Hi @Nicholas,
The App Service's managed identity has been assigned the Owner role on the Azure Communication Services (ACS) Email resource, which should generally provide the required permissions.This means the authentication is successful, but the request is still being blocked by the ACS Email service,

Please confirm whether you're using:

A Managed Identity assigned to your App Service, or A Service Principal with AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET.

Ensure that the identity being used at runtime is the one that was granted the Owner role on the ACS resource. You can verify this by checking which credential type DefaultAzureCredential resolves to in production.

The ACS Email service only allows sending from approved sender addresses.

1.The sender email address used in your email_client.send() call is a verified sender domain or email address in your ACS resource.

2.The identity (service principle or managed identity) you're using has permission to send from that sender.

To get more detailed error information:

Go to your ACS Email resource in the Azure Portal.

Select Diagnostic settings.

Enable logging to a Log Analytics Workspace

Check for logs related to Microsoft.Communication/EmailServices/Send/action.
Sampath 3,885 Reputation points Microsoft External Staff Moderator

2025-05-19T10:05:54.7166667+00:00

Hi @Nicholas, Please check your private message and respond there. Thank you.
Sampath 3,885 Reputation points Microsoft External Staff Moderator

2025-05-27T04:25:06.7166667+00:00
Hi @Nicholas , Have you set the following environment variables in your production environment in App Service :

AZURE_CLIENT_ID=<your-app-client-id> AZURE_TENANT_ID=<your-azure-ad-tenant-id> AZURE_CLIENT_SECRET=<your-app-client-secret>
Sampath 3,885 Reputation points Microsoft External Staff Moderator

2025-05-28T11:44:37.1533333+00:00

Hi @Nicholas, if you are still encountering an error, please check your private message and reply back.

1 answer

Your answer

Bhargavi Naragani 7,940 Reputation points Moderator

2025-05-15T08:24:23.5233333+00:00

Hi @Nicholas,

It seems like you're trying to use a service principal with a secret to authenticate your Azure Communication Services (ACS) Email client in production. While it works fine in your local setup, you're seeing the error "(Denied) Denied by the resource provider" in production. This means the authentication is working, but the service principal doesn't have the right permissions to access the ACS Email service.

To fix this, you'll need to give the service principal the right Azure Role-Based Access Control (RBAC) role so it can properly access and use the ACS Email resource.

Navigate to the Azure Portal: https://portal.azure.comGo to Resource Groups or All Resources. Select your Azure Communication Services resource. In the left-hand menu, click on Access control (IAM) then Click on + Add => Add role assignment.

Choose a role that provides the necessary permissions. For ACS Email, suitable roles include:

Contributor: Grants full access to manage all resources, excluding the ability to assign roles.

Owner: Grants full access, including the ability to assign roles.

Custom Role: If you prefer more granular control, create a custom role with specific permissions like Microsoft.Communication/EmailServices/Send/action.

In the Members tab, select User, group, or service principal. Search for your service principal by name and select it. Review your selections and click Review + assign. Allow a few minutes for the role assignment to propagate.

What is Azure role-based access control (Azure RBAC)?
Assign Azure roles using the Azure portal
Azure built-in roles - Azure RBAC
Authenticate to Azure Communication Services
Azure permissions - Azure RBAC

Hope the above provided information help you resolve the issue, if you have any further concerns or queries, please feel free to reach out to us.
Nicholas 25 Reputation points

2025-05-15T09:06:03.3933333+00:00

I've done this, I've added my App Service as Communication and Email Service Owner
Laxman Reddy Revuri 5,475 Reputation points Microsoft External Staff Moderator

2025-05-15T10:04:16.61+00:00

Hi @Nicholas,
The App Service's managed identity has been assigned the Owner role on the Azure Communication Services (ACS) Email resource, which should generally provide the required permissions.This means the authentication is successful, but the request is still being blocked by the ACS Email service,

Please confirm whether you're using:

A Managed Identity assigned to your App Service, or A Service Principal with AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_CLIENT_SECRET.

Ensure that the identity being used at runtime is the one that was granted the Owner role on the ACS resource. You can verify this by checking which credential type DefaultAzureCredential resolves to in production.

The ACS Email service only allows sending from approved sender addresses.

1.The sender email address used in your email_client.send() call is a verified sender domain or email address in your ACS resource.

2.The identity (service principle or managed identity) you're using has permission to send from that sender.

To get more detailed error information:

Go to your ACS Email resource in the Azure Portal.

Select Diagnostic settings.

Enable logging to a Log Analytics Workspace

Check for logs related to Microsoft.Communication/EmailServices/Send/action.
Sampath 3,885 Reputation points Microsoft External Staff Moderator

2025-05-19T10:05:54.7166667+00:00

Hi @Nicholas, Please check your private message and respond there. Thank you.
Sampath 3,885 Reputation points Microsoft External Staff Moderator

2025-05-27T04:25:06.7166667+00:00

Hi @Nicholas , Have you set the following environment variables in your production environment in App Service :

AZURE_CLIENT_ID=<your-app-client-id> AZURE_TENANT_ID=<your-azure-ad-tenant-id> AZURE_CLIENT_SECRET=<your-app-client-secret>
Sampath 3,885 Reputation points Microsoft External Staff Moderator

2025-05-28T11:44:37.1533333+00:00

Hi @Nicholas, if you are still encountering an error, please check your private message and reply back.

Answer 1

Hello @Nicholas ,

Set the following environment variables in your production environment in App Service :


AZURE_CLIENT_ID=<your-app-client-id>

AZURE_TENANT_ID=<your-azure-ad-tenant-id>

AZURE_CLIENT_SECRET=<your-app-client-secret>

Make sure you enable Identity in the Azure Web App, enable System Assigned Managed Identity, and assign the appropriate roles such as 'Communication and Email Service Owner', or any other required roles?

If you are having below problems

after enabling identity, follow the process below:

After enabling identity, go to Communication Service and select Access Control. Then, select Communication and Email Service Owner, choose Managed Identity, search for the web app name with identity enabled, assign roles, and try again.

Hope this helps!

If this answers your query, do click Accept Answer and Yes for was this answer helpful, which may help members with similar questions.

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.

Sampath 3,885 Reputation points Microsoft External Staff Moderator

2025-06-03T09:03:33.2966667+00:00

Hello @Nicholas , Just checking in to see if the provided answer helped. If it did, please click "Accept the answer” and Yes for the answer . So it can benefit other community members reading this thread. If you have any further queries, do let us know.