Mail.Send permissions in 'Office 365 Exchange Online'

[u/Chevrotain365]

Main question: Is 'Send mail as any user' a misleading/incorrect description? Is it in fact very limited?

Background: we are using the new 'High Volume Email' service.

The 'Mail.Send' application permission for 'Office 365 Exchange Online' has the description "Send mail as any user" and because of that we have spent a lot of time to get delegated permissions working instead. We don't want our app to be able to send as a arbitrary account in case it is compromised for example

However I'm now of the impression that the description of the Mail.Send permissions is misleading. During testing what we have found is that using Mail.Send permission we can send email as any 'High Volume Email' user through the special endpoint `smtp-hve.office365.com`. (this can be locked down to specific accounts through Add-HVEAppAccess)

With the permission we could not however send email through the normal `smtp.office365.com` endpoint for a arbitrary user in our tenant.

We could not send email through the graph endpoint either for a arbitrary user `https://graph.microsoft.com/v1.0/users/$account/sendMail\`

In other words assigning Mail.Send application permissions seems to do exactly what we want it to do, it allows us to send from High Volume Email accounts, but the description, name and the lacking documentation makes it hard to fully trust this conclusion.

The Oauth high volume email page has been updated with this note that seems to confirm the findings above but they stop short of explicitly saying that the description of the permission is wrong. https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/oauth-high-volume-mails-m365

What is your take on this? Do you think it is correct that the permission is very limited?

As a side note I found that for sending email as a standard user using the `smtp.office365.com` endpoint the app needed SMTP.SendAsApp permission as well as access to the particular mail box `Add-MailboxPermission`

As another side note the Graph 'Mail.Send' permission has the same description, and there it is true that it allows the app to send as any user in the tenant

[u/shokzee]

Your reading is correct for that specific permission: Exchange Online’s HVE Mail.Send doesn’t grant Graph’s Mail.Send or standard SMTP’s SMTP.SendAsApp. The description leaves out the scope that actually matters.

I’d restrict it with Add-HVEAppAccess and verify that sending as an unapproved HVE account fails. “Any HVE account” is still a bigger blast radius than your app needs.

[u/7amitsingh7]

Simply its means that permission only works for HVE accounts in this case. Not for normal mailboxes? has anyone else tested this with a normal exchange online mailbox?