Alert mail from one mailbox only
Alerts are sent from a shared mailbox that the engine may send as - and no other mailbox in the tenant.
Purpose
An app that may send mail as any mailbox is a risk of its own. Alerts must reach the right people without giving the product that right.
Design
A setup script creates a shared mailbox (no license), gives the engine identity the right to send as that one mailbox through Exchange role-based access for applications, removes any tenant-wide send right from the identity, and stores the sender and the recipients. The sender is shown in the web app, not edited there.
Business opportunities
Alerts reach your security team, and the product holds the narrowest mail right Exchange Online offers.
Related features
A hybrid worker for Active Directory
Tags of AD-synced users are written in Active Directory by a small worker that only connects out and has no password.
Jobs on your schedule
Every job runs on the schedule you set - daily, weekly or every few hours - with Preview and Apply on demand.
Tamper monitor
Reports every change to a watched tag that Entra Policy Suite did not make, with who made it and what it means.
Runs in your Azure, one identity per part
Container Apps jobs, a web app and an Azure SQL database in your subscription, each part on its own managed identity with only its own rights.