One of our developers recently faced a problem: they needed a Power Automate flow to send official email notifications from a departmental shared mailbox. However, there was a strict requirement that the account used by the flow’s connection (the account that owns and runs the flow) must not be able to open, view, or read anything in that mailbox.
Most of the “quick fixes” that you find online recommend granting Full Access permissions to the shared mailbox. While this makes the flow work quickly, it also it also gives that account the ability to open and read the entire inbox, which may pose a major privacy and security risk.
What we needed instead is a least-privilege approach: allow the flow to send email from the shared mailbox, while keeping the mailbox contents locked down.
Mailbox “Send As” or “Full Access” Permissions?
In Microsoft 365, Send As lets you send from a shared mailbox without granting Full Access to the mailbox or its inbox.
- Full Access: Allows an account to open the mailbox, read every email, download attachments, and deleting or moving items etc.
- Send As: Allows an account to send emails using the shared mailbox address in the From field. Recipients see the department mailbox as the sender, while the account that owns and runs the flow remains “blind” to the mailbox content.
For this flow, we need to use the Send As permission.
Step 1: Grant the account Send As permission to the Shared Mailbox
Your Exchange Administrator needs to grant the flow’s service account (i.e. the flow maker’s account) the Send As permission on the Shared Mailbox.
Screenshot of the Exchange Admin Centre: granting ‘Send As’ permissions for the IT Invoices shared mailbox.
Animation showing the IT Invoices shared mailbox settings in Microsoft 365, granting the Send As permission to the flow’s service account (the flow owner’s account).
The changes are saved and the new permissions should take effect within about 5 minutes, but it can take longer.
Step 2: Use the Send an Email action
Use the Outlook Send an Email action in your flow, then set the From (Send As) address to the Shared Mailbox.
Don’t use the Send an email from a shared mailbox (V2). This action typically requires the flow account to have Full Access permissions to the mailbox.
Expanding Show advanced options in the Send an email (V2) action to access additional settings, including the From field for sending as a shared mailbox.Step 3: Test the Flow
Test the flow to confirm that we can send emails from the shared mailbox:
Successful execution of the Power Automate flow for sending an email using a shared mailbox.Step 4: Try Opening the Shared Mailbox
When I try to open the shared mailbox (IT Invoices mailbox), access is denied, confirming that the account cannot view any emails.
Animation showing Outlook on the web with my (empty) inbox. When I try to open the shared mailbox, I can’t open it or view any emails.
Access is denied when I try to open the IT Invoices shared mailbox:
Access denied error message in Outlook while attempting to open the shared mailbox.WARNING: Sent Emails are not stored in the Shared Mailbox
When we grant the Send As or Full Access permission via the Exchange Admin Center, the flow can send successfully, but you will run into a major issue: a copy of the sent email is NOT saved in the shared mailbox’s Sent Items folder.
Sent emails in Power Automate are saved in the flow connection account’s Sent Items by default, not the shared mailbox.
By default, Exchange saves sent emails in the mailbox of the account that actually performs the send action. In a Power Automate flow, this is the account used by the flow’s connection, so sent emails are saved in that account’s Sent Items rather than in the shared mailbox’s Sent Items folder.
We can use a PowerShell script to do fix this, but you will need to be an Exchange Administrator, or you will need to ask your Exchange administrator to run the script for you.
The following script grants the service account Send As permission on the required shared mailbox and it also ensures that a copy of every sent message is saved in the shared mailboxes’ own “Sent Items” folders:
1 2 3 4 5 6 7 8 9 10 11 | $SharedMailbox = "it.invoices@cdev365.com"
$ServiceAccount = "ellis.karim@cdev365.com"
Add-RecipientPermission -Identity $SharedMailbox -Trustee $ServiceAccount -AccessRights SendAs -Confirm:$false
Set-Mailbox -Identity $SharedMailbox -MessageCopyForSentAsEnabled $True
Get-RecipientPermission -Identity $SharedMailbox -Trustee $ServiceAccount | Select-Object Trustee, AccessRights
|
Animation showing PowerShell script running to grant ‘Send As’ permission for the IT Invoices Shared Mailbox, ensuring also that email sent items are saved correctly to the Shared Mailbox.
The video below demonstrates the key behaviour we discussed above. It shows the flow being run and then checks the Outlook Sent Items folder, demonstrating where Exchange saves the message after the email is sent.
https://youtu.be/SpJWupd0UO0
Originally published on Ellis Karim's Blog - How to Send Emails from a Shared Mailbox in Power Automate (Without Giving Up Privacy) –
