Identity and authorization are separate
The certificate-backed Entra application proves which software requests a Microsoft token. Exchange Application RBAC determines what that application may do. RelayBridge uses sender-scoped RBAC rather than a broad Entra mail permission.
Objects created or verified by setup
- the Exchange service-principal reference for the customer-owned Entra application;
- a RelayBridge-marked distribution group containing only the selected sender mailbox;
- a management scope whose recipient filter is tied to that group; and
- exactly one scoped
Application SMTP.SendAsAppassignment for the application.
Setup verifies that the selected mailbox is in scope and that conflicting or extra grants are absent. Unexpected broadening fails validation instead of being silently accepted.
Sender boundary during delivery
The active sender must be a real Exchange Online mailbox. Every queued envelope sender must match that active sender, and every local device also has an exact sender allowlist.
Do not rely on the message-header From value or display name as the authorization boundary. RelayBridge evaluates the SMTP envelope sender before durable acceptance and uses that queued envelope sender for Exchange delivery.
RelayBridge does not request mailbox-reading access. Tenant-side edits to the sender group, management scope, service-principal reference, or role assignment can invalidate prior evidence and require repair or verification.