Email setup issues About Azure Communication Services

Azure Communication Services (ACS) Email does not require configuring a conventional sending mailbox; configure an ACS Email domain and authenticate your application to the ACS SMTP endpoint using either SMTP username/client-secret credentials or XOAuth2.

Required ACS configuration

1. Create an Azure Communication Email resource and provision either:
   • An Azure-managed *.azurecomm.net domain, or
   • Your own custom domain, verified in ACS.
2. Connect the Email resource and domain to the ACS resource.
3. Register a Microsoft Entra application and create a client secret.
4. Grant the Entra application access to the ACS resource:
   • Use the built-in Communication and Email Service Owner role; or
   • For narrower permissions, use a custom role containing:
     • Microsoft.Communication/CommunicationServices/Read
     • Microsoft.Communication/CommunicationServices/Write
     • Microsoft.Communication/EmailServices/write
5. In Azure portal → Azure Communication Services resource → SMTP Usernames, select Add SMTP Username, associate it with the Entra application, and wait until its status is Ready to use. The username can be free-form or email-formatted; if it is email-formatted, its domain must be one of the domains linked to the ACS resource.^1^

SMTP client settings

Configure the sending application or device as follows:

Use the DNS hostname rather than an IP address. The selected port must also be permitted by the application’s network, firewall, or ISP.^1^

The username is therefore not an Exchange mailbox username, and its password is not a mailbox password. ACS maps the SMTP Username to the Entra application and uses that application’s identity to authorize email submission.

Authentication choices

ACS supports these two documented SMTP authentication patterns:

• SMTP username and password: supply the ACS SMTP Username as the username and the Entra application client secret as the password.^1^
• XOAuth2: obtain an Entra application token for the https://communication.azure.com/.default scope, then authenticate the SMTP connection using the SMTP Username and access token. Microsoft provides a .NET MailKit implementation of this flow.^2^

A minimal MailKit connection using XOAuth2 is:

using var client = new MailKit.Net.Smtp.SmtpClient();

await client.ConnectAsync(
    "smtp.azurecomm.net",
    587,
    MailKit.Security.SecureSocketOptions.StartTls);

var auth = new MailKit.Security.SaslMechanismOAuth2(
    smtpUsername, entraAccessToken);

await client.AuthenticateAsync(auth);
await client.SendAsync(message);
await client.DisconnectAsync(true);

Sender-domain requirements

The message’s From address must use the MailFrom address of the domain provisioned or verified in ACS, not an arbitrary mailbox address. ACS supports SPF and DKIM authentication for Azure-managed and custom domains.^3^

For a custom domain, complete its ACS domain-verification and sender-authentication records before using its MailFrom address. No IMAP, POP, Exchange mailbox, or mailbox-side SMTP AUTH configuration is needed for this outbound ACS flow.

References

1. Create credentials for Simple Mail Transfer Protocol (SMTP) authentication
2. Send email with SMTP and XOAuth2 using .NET
3. Email SMTP support in Azure Communication Services