Sending email from your own address

If you do nothing

Waystone sends its emails (reminders, digests, scheduled reports, certificates) from lms-noreply@underhillsystems.com, a mailbox in Underhill Systems' own Microsoft 365. Nothing in your organization is involved.

How it works

Sending uses a separate app, Waystone Mail. In Entra ID it asks for no application permissions, only the basic delegated User.Read every app needs to be added to a directory. The right to send comes from Exchange Online RBAC for Applications: you give Waystone Mail the Application Mail.Send role, limited to an administrative unit that contains only your sender mailbox. Exchange refuses anything else.

Until the test in step 6 passes, Waystone keeps sending from its own address, so email never stops halfway through setup.

Before you start

• In Waystone Learn, go to Settings → Send from your own address, enter the address and save. The page fills in every value below, with copy buttons.
• You'll need a Global or Application Administrator (step 1), someone who can manage administrative units (step 3), and an Exchange administrator (steps 4 and 5).
• The sender must be an Exchange Online mailbox. A shared mailbox is fine.

Setup

1. Approve Waystone Mail

   Use Approve Waystone Mail in Settings. Microsoft's consent screen lists only "Sign you in and read your profile" (User.Read). This creates the app in your directory and grants no permission to send.

2. Find the Object ID

   Entra admin center → Enterprise applications → "Waystone Mail" → Overview → copy the Object ID. Use the one under Enterprise applications, not App registrations.

3. Create an administrative unit

   Entra admin center → Roles & admins → Admin units → Add. Name it Waystone sender, add only the sender mailbox's user, and copy the unit's Object ID.

4. Allow sending from that unit only

   In Exchange Online PowerShell, signed in as your own admin. {appId} is the Application (client) ID shown in Waystone.

   Connect-ExchangeOnline
   New-ServicePrincipal -AppId {appId} -ObjectId <Object ID from step 2> -DisplayName "Waystone Mail"
   New-ManagementRoleAssignment -App {appId} -Role "Application Mail.Send" -RecipientAdministrativeUnitScope <Admin unit Object ID>

   Copy

   New-ServicePrincipal registers the app with Exchange and grants nothing by itself. The role assignment grants exactly one role (send, no read), limited to the unit.

5. Verify with Microsoft's own tool

   Test-ServicePrincipalAuthorization -Identity {appId} -Resource training@contoso.com   # expect InScope: True
   Test-ServicePrincipalAuthorization -Identity {appId} -Resource someone@contoso.com    # expect InScope: False

   Copy

   Try any other address in place of someone@contoso.com. Every one should come back InScope: False.

6. Test in Waystone

   In Settings → Send from your own address, select Test sender. It sends no email:

   Check	What it proves
   Waystone Mail is approved	Waystone Mail can sign in to your directory (step 1 is done).
   No permission to send as everyone	Neither Waystone app holds Mail.Send, Mail.ReadWrite, Mail.Read or Mail.ReadBasic.All in Entra ID. If one does, the test fails and shows how to remove it.
   Other addresses are refused	The proof. Waystone tries to send as your own admin account, with a message addressed to no one. Exchange must refuse it, or the test fails.

   When every check passes, the status becomes Verified and emails go out from your address. Changing the address later starts the test over.