Warm tip: This article is reproduced from serverfault.com, please click

Importance of 'supported account type' when registering an app with application permission

发布于 2020-12-23 18:56:05

I build a web app which send mails (with Microsoft Graph) but not on behalf of users. Rather think of a 'do-not-reply email' sent to users with some info. The application should have "Mail.Send" application permission on Microsoft Graph. The mail address is do-not-reply@contoso.com and this is an application mailbox (shared mailbox).

So the basic scenario is:

  • User John Doe fill in a form on contoso.com website and submit it
  • A mail is sent to the user to confirm the submission of the form
  • The mail sender is ALWAYS do-not-reply@contoso.com and the mail receiver is (in this case) john.doe@anything.com

Given my explanations, I think of registering an application on my Azure Active Directory with "application permission" (request for admin consent) Client Crediential Flow. Correct ?

Also, is there any importance when choosing the Supported account types when registering a new application with "application permission" ? From my understanding, since the administrator consent permission from the start of the implementation, this account type choice has no impact.

Please correct me if I'm wrong.

enter image description here

Questioner
Bronzato
Viewed
0
Allen Wu 2020-12-24 09:36:49

Yes. You should follow Get access without a user to get the access token. It uses "application permission" with Client Credential Flow.

And "supported account types" only effects where the Azure AD app can be used. It doesn't effect on which authentication flow you use. If you just want to use it in your own Azure AD tenant, just choose the first Accounts in this organizational directory only. See details here.