Notifications

Send mail through Microsoft 365 with no SMTP

Microsoft has been switching SMTP authentication off across tenants, which leaves a self hosted tool with nothing to connect to. The answer is to send through the Graph API as an application, which needs three values from Azure and about five minutes.

What to do

In the Azure portal, go to Microsoft Entra ID, then App registrations, and register a new application. A single tenant application is correct here.
Copy the Application (client) ID and the Directory (tenant) ID from the overview page.
Under Certificates and secrets, create a new client secret and copy the value immediately. Azure shows it once.
Under API permissions, add an application permission (not delegated) for Microsoft Graph: Mail.Send. Then press Grant admin consent, or nothing will work.
Decide which mailbox it sends as. A shared mailbox is the usual answer, because a person leaves and their mailbox goes with them.
In Git Code Review, open Notifications, choose Microsoft Graph as the mail method, and enter the tenant ID, client ID, client secret and the from address.
Press Send a test. If it fails, the message says which of the four it was, rather than a generic failure.

Worth knowing

Restrict that application permission to the one mailbox with an application access policy. Without one, Mail.Send as an application means every mailbox in the tenant.