Need Help Creating and Configuring Azure Communication Services (Email)

Saikumar Polavaram 20 Reputation points
2026-07-20T21:53:00.26+00:00

Hi everyone,

I need some guidance on creating and configuring Azure Communication Services (ACS) Email for my application.

My Requirement

I want to use Azure Communication Services Email to send email notifications from my application. I need to create the Email Communication Service in Azure and configure it correctly.

I Need Help With

  1. Creating an Azure Communication Services resource.
  2. Creating and configuring an Email Communication Service.
  3. Connecting the Email Communication Service to the ACS resource.
  4. Configuring a custom domain (or using the Azure-managed domain for testing).
  5. Creating the required App Registration in Microsoft Entra ID (if needed).
  6. Assigning the required Azure RBAC roles or custom roles to the application/service principal.
  7. Generating the connection string and access keys.
  8. Configuring SMTP or the Email SDK to send emails from my application.
  9. Understanding the required permissions and best practices for production deployments.
  10. Any common issues or prerequisites that I should be aware of.

I would really appreciate it if someone could provide a step-by-step guide or share Microsoft documentation that covers the complete setup from resource creation to successfully sending emails from an application.

Thank you in advance for your help!

Azure Communication Services

Answer accepted by question author

Divyesh Govaerdhanan 11,725 Reputation points MVP Volunteer Moderator
2026-07-20T22:06:14.42+00:00

Hi Saikumar Polavaram,

Welcome to Microsoft Q&A,

1. Create resources - You need two: an Azure Communication Services resource, and a separate Email Communication Services resource (Portal → Create a resource → search each name).

2. Add a domain - Under the Email Communication Services resource → Provision domains. Azure Managed Domain for testing (auto-verified, limited sending). Custom Domain for production (add the SPF/DKIM/DKIM2/DMARC records it gives you at your DNS provider).

3. Link domain to ACS - ACS resource → Domains → Link Domain, pick the verified one.

4. Entra App Registration - Only needed if authenticating via Entra ID or SMTP+OAuth. Not required for connection string auth.

5. RBAC — If using Entra auth, assign the service principal Contributor (or a scoped custom role) on the ACS resource under IAM.

6. Get credentials — ACS resource → Keys, for connection string/access keys. For SMTP, generate an SMTP username under the SMTP auth docs.

7. Send email

  • SDK (recommended): Azure.Communication.Email / @azure/communication-email etc. Init EmailClient with connection string, key, or Entra credential, call Send.
  • SMTP: smtp.azurecomm.net, port 587, using the SMTP username/password.

8. Production tips — Use Entra auth over raw connection strings, use a custom domain (not Azure managed), configure DMARC properly, watch sending quotas.

9. Common issues — Domain verification stuck = missing/unpropagated DNS record. SMTP failing = missing role assignment. Landing in spam = DMARC misconfigured.

Docs:

Please Upvote and accept the answer if it helps!!

Was this answer helpful?

1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Ajay Rathod 170 Reputation points Microsoft External Staff Moderator
    2026-07-21T00:14:13.9733333+00:00

    Hi @Saikumar Polavaram

    Happy to walk you through the full path from resource creation to a successful send. Here are the 10 steps mapped to your list, followed by the one known issue that trips up most first-time setups and the doc links for each stage.

    Step-by-step: ACS Email, end to end

    1. Create the Azure Communication Services (ACS) resource : In the portal, search Communication Services → Create, pick your subscription/resource group, name it, and deploy. (CLI equivalent: az communication create.) → https://learn.microsoft.com/azure/communication-services/quickstarts/create-communication-resource

    2. Create the Email Communication Service : This is a separate resource type. Search Email Communication Services → Create → deploy. Think of ACS as the sender engine and the Email Communication Service as the domain/identity holder. → https://learn.microsoft.com/azure/communication-services/quickstarts/email/create-email-communication-resource

    1. Provision a domain on the Email Communication Service Open the Email Communication Service → Provision Domains. You have two choices:

    4. Configure the custom domain (or use managed for testing) Custom domain is a two-stage process:

    • Stage 1 – Prove ownership: publish the TXT record shown in the Verify Domain via TXT record dialog.
    • Stage 2 – Sender authentication: publish the SPF (TXT) + DKIM/DKIM2 (CNAME) records. For a subdomain like visitreports, when you add records in the parent zone, the names carry the label — exactly like this:
    Record Type Name Value
    DKIM CNAME selector1-azurecomm-prod-net._domainkey.visitreports selector1-azurecomm-prod-net._domainkey.azurecomm.net
    DKIM2 CNAME selector2-azurecomm-prod-net._domainkey.visitreports selector2-azurecomm-prod-net._domainkey.azurecomm.net
    SPF TXT visitreports v=spf1 include:spf.protection.outlook.com -all

    DNS changes take 15–30 minutes to propagate. Verify with nslookup -q=TXT visitreports.<yourrootdomain> and nslookup -q=CNAME selector1-azurecomm-prod-net._domainkey.visitreports.<yourrootdomain>. → https://learn.microsoft.com/azure/communication-services/concepts/email/email-domain-and-sender-authentication

    5. App Registration in Microsoft Entra ID (only if you use Entra auth): You do not need this if you authenticate with the connection string. You do need it if you plan to use Microsoft Entra ID (service principal / managed identity) or SMTP. Register the app and create a client secret. → https://learn.microsoft.com/azure/communication-services/quickstarts/identity/service-principal

    6. Assign Azure RBAC roles to the app/service principal Grant the Entra app access to the ACS resource via Access control (IAM). Use the built-in Communication and Email Service Owner role, or a custom role limited to Microsoft.Communication/CommunicationServices/Read, Microsoft.Communication/CommunicationServices/Write, and Microsoft.Communication/EmailServices/write. → https://learn.microsoft.com/azure/communication-services/quickstarts/email/send-email-smtp/smtp-authentication#assign-a-role-to-the-microsoft-entra-application

    7. Connect the Email Communication Service to the ACS resource + get the connection string Once the domain shows Verified, link it: ACS resource → Domains → Connect domain (CLI: az communication update --linked-domains <domainId>). Then grab the connection string / key from ACS → Keys. → Link domain: https://learn.microsoft.com/azure/communication-services/quickstarts/email/connect-email-communication-resource → Store connection string: https://learn.microsoft.com/azure/communication-services/quickstarts/create-communication-resource#store-your-connection-string

    8. Configure the SDK or SMTP to send

    9. Permissions & production best practices

    10. Common issues / prerequisites to know up front

    • Custom-domain setup is two records deep — the ownership TXT and SPF/DKIM. Skipping the TXT is the #1 reason SPF/DKIM won't verify.
    • Domain must be Verified and linked before a send works, otherwise you'll get DomainNotLinked/Unauthorized.
    • The MailFrom address must belong to your verified domain.

    Known issue (reported by another user) — SPF stuck on "Failed"

    A common failure: ACS requires the SPF record to end in -all, but many tenants already have an Office 365 SPF record ending in ~all. ACS won't accept ~all, and you can only have one SPF record per label — so you must merge into a single record ending in -all, e.g.:

    v=spf1 mx a include:servers.mcsv.net include:spf.protection.outlook.com -all

    Then lower the SPF TTL to ~300s while troubleshooting so retries pick up faster. This is confirmed in an accepted Microsoft Q&A answer. → Known-issue thread (accepted answer): https://learn.microsoft.com/answers/a/12150360 → SPF troubleshooting doc: https://learn.microsoft.com/azure/communication-services/concepts/email/email-domain-configuration-troubleshooting

    SPF troubleshooting — https://learn.microsoft.com/azure/communication-services/concepts/email/email-domain-configuration-troubleshooting

    Thanks

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.