Customer-owned application identity
RelayBridge creates or verifies a single-tenant Entra application owned by the customer tenant. The tenant-local service principal represents that application to Exchange. RC1 supports one tenant, one active application identity, and one authorized sender.
The application has one matching public certificate credential and no client secret. Runtime delivery does not require Graph application permissions or service-principal app-role assignments. Microsoft Graph participates in installer-provisioned administration; it is not the RC1 mail-delivery path or fallback.
Local certificate lifecycle
The wizard can generate an RSA-2048 SHA-256 certificate with a one-year default validity. On an installed system, it is placed in the Local Computer Personal certificate store, LocalMachine\My. Its CNG private key is created non-exportable.
RelayBridge stores a certificate reference rather than a PFX or private-key copy. The exported .cer contains only public certificate material and is used to register the public credential with Entra. Runtime token acquisition uses the installed certificate and the private key that remains on the RelayBridge machine.
If the certificate expires, is removed, or becomes inaccessible to the service, use the Microsoft setup repair flow. Do not work around the failure with a client secret or exported private key.
What Diagnostics can show
Diagnostics reports certificate presence, private-key accessibility, validity, expiry, and only an abbreviated reference. It does not place a private key or complete certificate reference in the support bundle.
Tenant administrators can later alter the application, service principal, certificate registration, or Exchange authorization. Such changes can invalidate earlier RelayBridge evidence and require verification or repair.