Send Emails via Microsoft Graph API Using PowerShell and App Registration

Microsoft Graph API is the unified gateway to Microsoft 365 data and services. One of the most common automation scenarios is sending emails programmatically — without relying on a logged-in user, Outlook, or SMTP. In this post, we'll walk through how to register an Azure AD app, grant it the right permissions, and use a single end-to-end PowerShell script to send emails and query SharePoint via Graph API using client credentials (app-only auth).

---

Why Use Graph API for Sending Emails?

• No user sign-in required — works great for background jobs, bots, and automation flows
• Works from anywhere — PowerShell scripts, Power Automate Desktop, Azure Functions, etc.
• Scalable and auditable — full control over sending identity and logging

---

Step 1: Register an App in Microsoft Entra ID (Azure AD)

Before writing any code, you need an app registration that represents your script or automation.

1. Go to https://portal.azure.com
2. Navigate to Microsoft Entra ID → App registrations → New registration
3. Give it a meaningful name (e.g., GraphAPI-MailSender)
4. Leave Redirect URI blank — not needed for client credentials flow
5. Click Register

Once created, note down:

• Application (client) ID → used as $clientId in the script
• Directory (tenant) ID → used in the token endpoint URL

---

Step 2: Create a Client Secret

1. Go to Certificates & secrets → New client secret
2. Add a description and set an expiry (e.g., 12 months)
3. Copy the Value immediately — it won't be shown again
4. Store it securely (Azure Key Vault is recommended for production)

---

Step 3: Grant API Permissions

Your app needs the following Application permissions (not Delegated):

Permission	Purpose
Mail.Send	Send email as any mailbox in the tenant
Sites.Read.All	Read SharePoint site data

Steps:

1. Go to API permissions → Add a permission → Microsoft Graph → Application permissions
2. Add Mail.Send and Sites.Read.All
3. Click Grant admin consent — required for application permissions

⚠️ Mail.Send as an application permission allows sending mail as any user in the tenant. Use application access policies to restrict it to specific mailboxes in production.

---

Step 4: Full PowerShell Script

The script below handles everything in sequence:

1. Acquires a token using client credentials
2. Sends an email via Graph API
3. Reuses the token to query the SharePoint root site

# ============================================================
# Microsoft Graph API — Send Email + Query SharePoint Root Site
# Using App-Only (Client Credentials) Authentication
# ============================================================

# ── Configuration ──────────────────────────────────────────
$clientId     = "<YOUR_CLIENT_ID>"       # Application (client) ID
$clientSecret = "<YOUR_CLIENT_SECRET>"   # Client secret value
$tenantId     = "<YOUR_TENANT_ID>"       # Directory (tenant) ID
$senderUPN    = "sender@yourdomain.com"  # Mailbox used to send email
$recipientUPN = "recipient@yourdomain.com" # Target recipient

# ── Part 1: Acquire Access Token ────────────────────────────
Write-Output "Acquiring access token..."

$tokenBody = @{
    client_id     = $clientId
    client_secret = $clientSecret
    scope         = "https://graph.microsoft.com/.default"
    grant_type    = "client_credentials"
}

$tokenResponse = Invoke-RestMethod `
    -Uri    "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" `
    -Method POST `
    -Body   $tokenBody

$token = $tokenResponse.access_token
Write-Output "Token acquired successfully."

# ── Part 2: Send Email via Graph API ────────────────────────
Write-Output "Sending email..."

$mailPayload = @{
    message = @{
        subject = "Test Email from Graph API"
        body    = @{
            contentType = "Text"
            content     = "This is a test email sent via Microsoft Graph API using PowerShell with app-only authentication."
        }
        toRecipients = @(
            @{
                emailAddress = @{
                    address = $recipientUPN
                }
            }
        )
    }
} | ConvertTo-Json -Depth 10

$headers = @{
    Authorization  = "Bearer $token"
    "Content-Type" = "application/json"
}

try {
    Invoke-RestMethod `
        -Uri         "https://graph.microsoft.com/v1.0/users/$senderUPN/sendMail" `
        -Method      POST `
        -Headers     $headers `
        -Body        $mailPayload `
        -ContentType "application/json"

    Write-Output "✅ Email sent successfully to $recipientUPN"
}
catch {
    Write-Error "❌ Failed to send email: $_"
}

# ── Part 3: Query SharePoint Root Site ──────────────────────
Write-Output "`nQuerying SharePoint root site..."

try {
    $rootSite = Invoke-RestMethod `
        -Uri     "https://graph.microsoft.com/v1.0/sites/root" `
        -Method  GET `
        -Headers $headers

    Write-Output "✅ SharePoint root site retrieved:"
    Write-Output ($rootSite | ConvertTo-Json -Depth 3)
}
catch {
    Write-Error "❌ Failed to query SharePoint root site: $_"
}

---

How to Run the Script

1. Open PowerShell (or Windows PowerShell ISE / VS Code)
2. Replace the four placeholder values at the top of the script:
   • <YOUR_CLIENT_ID>
   • <YOUR_CLIENT_SECRET>
   • <YOUR_TENANT_ID>
   • sender@yourdomain.com and recipient@yourdomain.com
3. Save as Send-GraphEmail.ps1
4. Run:

.\Send-GraphEmail.ps1

Expected Output

Acquiring access token...
Token acquired successfully.
Sending email...
✅ Email sent successfully to recipient@yourdomain.com

Querying SharePoint root site...
✅ SharePoint root site retrieved:
{
  "id": "yourtenant.sharepoint.com,xxxxxxxx-...",
  "displayName": "Communication site",
  "name": "root",
  "webUrl": "https://yourtenant.sharepoint.com"
}

---

Script Breakdown

Section	What it does
Configuration block	Centralises all credentials and addresses at the top — easy to maintain
Token acquisition	Posts to the OAuth 2.0 token endpoint using client credentials
Email sending	Constructs the mail JSON payload and calls /users/{sender}/sendMail
SharePoint query	Reuses the same token to call /sites/root — no second token needed
try/catch blocks	Catches errors per operation so one failure doesn't stop the rest

---

Security Best Practices

Practice	Recommendation
Never hardcode secrets	Move $clientSecret to Azure Key Vault or environment variables
Rotate secrets regularly	Set reminders before expiry; automate via Key Vault rotation
Restrict Mail.Send scope	Use application access policies to limit to specific mailboxes
Prefer certificates	Certificate-based auth (New-SelfSignedCertificate) is more secure than secrets
Audit permissions	Review app registrations and permissions in Entra ID quarterly

---

Summary

In this post, we covered:

• Registering an app in Microsoft Entra ID and creating a client secret
• Granting Mail.Send and Sites.Read.All application permissions with admin consent
• A complete PowerShell script that acquires a token, sends an email, and queries SharePoint — all using app-only auth
• Error handling with try/catch per operation
• Security recommendations for production use

This pattern is perfect for Power Automate Desktop flows, scheduled PowerShell jobs, or any scenario where no interactive user is present. The same token works across multiple Graph API endpoints — making it efficient to chain operations in a single script.

---

Tags: MicrosoftGraph, PowerShell, AzureAD, AppRegistration, Microsoft365, EmailAutomation, GraphAPI, EntraID, PowerAutomate, SharePoint

---

Part 2: End-to-End in Power Automate Desktop (PAD)

The same logic — get a token, send an email, query SharePoint — can run entirely inside a Power Automate Desktop flow without any external PowerShell script. PAD has built-in HTTP actions and a Run PowerShell script action, giving you two clean approaches.

---

Approach A: Using the "Run PowerShell Script" Action (Quickest Way)

This embeds the entire PowerShell script directly inside a PAD flow. Best when you already have the script and just want to automate it.

PAD Flow Structure

Flow: Send Email via Graph API
│
├── [1] Set Variable — clientId
├── [2] Set Variable — clientSecret
├── [3] Set Variable — tenantId
├── [4] Set Variable — senderUPN
├── [5] Set Variable — recipientUPN
├── [6] Run PowerShell Script
│       └── Script: (full script using %clientId%, %clientSecret%, etc.)
│       └── Output: PowershellOutput
├── [7] IF PowershellOutput contains "successfully"
│       └── Display Message — "Flow completed successfully"
│   ELSE
│       └── Display Message — "Flow encountered an error"
└── [8] (Optional) Write output to text file or log

Step-by-Step in PAD Designer

Step 1 — Set your variables

Add one Set variable action for each credential. Using variables (rather than hardcoding) keeps the script clean and makes future updates easy.

Variable Name	Value
clientId	Your Application (client) ID
clientSecret	Your client secret value
tenantId	Your Directory (tenant) ID
senderUPN	sender@yourdomain.com
recipientUPN	recipient@yourdomain.com

In PAD, go to Actions panel → Variables → Set variable, set Name and Value for each.

Step 2 — Add "Run PowerShell Script" action

Search for Run PowerShell script in the Actions panel (under Scripting). Paste the script below into the script body. PAD variables are referenced using %variableName% syntax inside the script block.

# ============================================================
# Graph API — Send Email + Query SharePoint Root Site
# Running inside Power Automate Desktop
# ============================================================

$clientId     = "%clientId%"
$clientSecret = "%clientSecret%"
$tenantId     = "%tenantId%"
$senderUPN    = "%senderUPN%"
$recipientUPN = "%recipientUPN%"

# ── Part 1: Acquire Token ────────────────────────────────────
$tokenBody = @{
    client_id     = $clientId
    client_secret = $clientSecret
    scope         = "https://graph.microsoft.com/.default"
    grant_type    = "client_credentials"
}

$tokenResponse = Invoke-RestMethod `
    -Uri    "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" `
    -Method POST `
    -Body   $tokenBody

$token = $tokenResponse.access_token

# ── Part 2: Send Email ───────────────────────────────────────
$mailPayload = @{
    message = @{
        subject = "Test Email from Graph API via PAD"
        body    = @{
            contentType = "Text"
            content     = "This email was sent via Microsoft Graph API running inside a Power Automate Desktop flow."
        }
        toRecipients = @(
            @{ emailAddress = @{ address = $recipientUPN } }
        )
    }
} | ConvertTo-Json -Depth 10

$headers = @{
    Authorization  = "Bearer $token"
    "Content-Type" = "application/json"
}

try {
    Invoke-RestMethod `
        -Uri         "https://graph.microsoft.com/v1.0/users/$senderUPN/sendMail" `
        -Method      POST `
        -Headers     $headers `
        -Body        $mailPayload `
        -ContentType "application/json"

    Write-Output "Email sent successfully to $recipientUPN"
}
catch {
    Write-Output "ERROR sending email: $_"
}

# ── Part 3: Query SharePoint Root Site ──────────────────────
try {
    $rootSite = Invoke-RestMethod `
        -Uri     "https://graph.microsoft.com/v1.0/sites/root" `
        -Method  GET `
        -Headers $headers

    Write-Output "SharePoint root site: $($rootSite.webUrl)"
}
catch {
    Write-Output "ERROR querying SharePoint: $_"
}

In the action settings:

• Script to run → paste the script above
• PowerShell script output → save to variable PowershellOutput
• Script error output → save to variable ScriptError

Step 3 — Handle output with an IF condition

Add an If action:

• First operand: %PowershellOutput%
• Operator: Contains
• Second operand: successfully

Inside the If block → add Display message: "✅ Email sent and SharePoint queried successfully"
Inside the Else block → add Display message: "❌ Flow error — check ScriptError variable"

Step 4 — (Optional) Log output to a file

Add a Write text to file action after the If block:

• File path: C:\PAD-Logs\GraphAPI-Run-%CurrentDateTime%.txt
• Text to write: %PowershellOutput%%NewLine%%ScriptError%
• If file exists: Append

---

Approach B: Using PAD HTTP Actions (No PowerShell Required)

PAD has native HTTP actions under Web → Invoke web service that can call REST APIs directly — no PowerShell needed. This is the cleanest approach for PAD-native flows.

PAD Flow Structure

Flow: Send Email via Graph API (HTTP Native)
│
├── [1]  Set Variable — clientId
├── [2]  Set Variable — clientSecret  
├── [3]  Set Variable — tenantId
├── [4]  Set Variable — senderUPN
├── [5]  Set Variable — recipientUPN
│
├── [6]  Invoke web service — POST token endpoint
│        └── Saves response → TokenResponse (JSON)
│
├── [7]  Get JSON key — extract access_token
│        └── Saves → AccessToken
│
├── [8]  Invoke web service — POST sendMail
│        └── Uses Bearer %AccessToken% in header
│        └── Saves response → MailResult
│
├── [9]  Invoke web service — GET sites/root
│        └── Uses Bearer %AccessToken% in header
│        └── Saves response → SharePointResult
│
└── [10] Display message — show results

Step-by-Step: HTTP Actions in PAD

Step 1 — Set variables (same as Approach A)

Step 2 — Get Access Token (Invoke web service)

Action: Web → Invoke web service

Field	Value
URL	https://login.microsoftonline.com/%tenantId%/oauth2/v2.0/token
Method	POST
Accept	application/json
Content type	application/x-www-form-urlencoded
Custom headers	(leave blank)
Request body	client_id=%clientId%&client_secret=%clientSecret%&scope=https://graph.microsoft.com/.default&grant_type=client_credentials
Save response into	TokenResponse

Step 3 — Extract the access token

Action: Variables → Get JSON key value
(or use Convert JSON to custom object then dot-notation)

• JSON: %TokenResponse%
• Key: access_token
• Save into: AccessToken

Alternatively, use a Run PowerShell script just for this one-liner:

$json = '%TokenResponse%' | ConvertFrom-Json
Write-Output $json.access_token

Save output into AccessToken.

Step 4 — Send Email (Invoke web service)

Action: Web → Invoke web service

Field	Value
URL	https://graph.microsoft.com/v1.0/users/%senderUPN%/sendMail
Method	POST
Accept	application/json
Content type	application/json
Custom headers	Authorization: Bearer %AccessToken%
Request body	(see JSON below)
Save response into	MailResult

Request body (paste as-is, update addresses via variables):

{
  "message": {
    "subject": "Test Email from PAD via Graph API",
    "body": {
      "contentType": "Text",
      "content": "This email was sent using Power Automate Desktop with Microsoft Graph API HTTP actions."
    },
    "toRecipients": [
      {
        "emailAddress": {
          "address": "%recipientUPN%"
        }
      }
    ]
  }
}

Step 5 — Query SharePoint Root Site (Invoke web service)

Action: Web → Invoke web service

Field	Value
URL	https://graph.microsoft.com/v1.0/sites/root
Method	GET
Accept	application/json
Custom headers	Authorization: Bearer %AccessToken%
Save response into	SharePointResult

Step 6 — Display results

Action: Message boxes → Display message
Message: SharePoint site: %SharePointResult%

---

Approach Comparison

	Approach A (Run PowerShell)	Approach B (HTTP Actions)
Complexity	Low — paste and run	Medium — multiple actions
PAD native	No (calls PowerShell)	Yes (pure PAD)
Debugging	Via script output variable	Per-action response variables
Best for	Existing PowerShell scripts	New PAD-native flows
Token parsing	Built into the script	Needs extra step in PAD
Error handling	try/catch in script	On block error / IF conditions

Recommendation: Use Approach A if you already have the PowerShell script. Use Approach B if you want a fully PAD-native flow with no external dependencies.

---

Tips for PAD Flows with Graph API

• Store secrets in PAD Input variables marked as Sensitive — they are masked in logs and not stored in plain text in the flow definition
• Add On block error handlers around each Invoke web service action to gracefully catch HTTP failures (401 Unauthorized, 403 Forbidden, etc.)
• Token expiry: The client credentials token is valid for 1 hour. For long-running flows, re-acquire the token mid-flow if needed
• Test in PAD debugger using the step-through (F10) to inspect each variable value before running end-to-end

---

Full Flow Summary

App Registration (Entra ID)
        │
        ▼
Client Credentials → OAuth 2.0 Token Endpoint
        │
        ▼
Access Token (Bearer)
        │
        ├──▶ POST /users/{sender}/sendMail   → Email delivered ✅
        │
        └──▶ GET  /sites/root               → SharePoint data ✅

All three entry points — standalone PowerShell, PAD via PowerShell action, and PAD via HTTP actions — use the exact same app registration, permissions, and token. The only difference is where and how the script runs.

---

Tags: MicrosoftGraph, PowerShell, PowerAutomateDesktop, PAD, AzureAD, AppRegistration, Microsoft365, EmailAutomation, GraphAPI, EntraID, SharePoint, RPA