Adding a Notification Email Address

This tutorial walks you through adding a new notification sender — an email address like newemployees@mckimcreed.com that shows a specific name (e.g. "New Employee(s)") when it lands in someone's inbox.

Our notification system already has an app registration (Notify-NoReply) that is allowed to send mail on behalf of any mailbox in the svc-notify-senders security group. So adding a new sender is really two things: create a shared mailbox with the name you want, then add it to that group. No changes to the app registration, no code changes to the auth side.

> Why a separate mailbox per name? Exchange Online always stamps the outgoing "From" name with the mailbox's own Display name — it ignores whatever name an app tries to set per message. So each distinct sender name needs its own shared mailbox. For the full background, see Sending Notification Email as a Shared Mailbox.

Prerequisites

• Exchange Administrator (or Global Administrator) role in Microsoft 365
• The display name you want recipients to see (e.g. New Employee(s))
• The email address for the new sender (e.g. newemployees@mckimcreed.com)
• The name of the target group — svc-notify-senders — and the app registration it serves — Notify-NoReply

> Shared mailboxes are free (no license required) and have sign-in disabled by default — there is no password to manage.

---

Manual steps (admin center)

Step 1: Create the shared mailbox

1. Go to the Exchange admin center → admin.exchange.microsoft.com
2. In the left menu, select Recipients → Mailboxes
3. Click Add a shared mailbox
4. Fill in:

• Display name — the name recipients will see, e.g. New Employee(s) (this is the important field — it becomes the "From" name on every message this sender sends)
• Email address — e.g. newemployees @ mckimcreed.com

1. Click Create
2. Go into properties and hide mailbox

Step 2: Open the svc-notify-senders group

1. In the Exchange admin center, go to Recipients → Groups
2. In the Mail-Enabled security list, find and click svc-notify-senders
3. Select the Members tab

Step 3: Add the new mailbox to the group

1. On the Members tab, click Add members
2. Search for the mailbox you created in Step 1 (e.g. New Employee(s) / newemployees@mckimcreed.com)
3. Check the box next to it and click Add
4. Confirm the member now appears in the list

This is the step that authorizes the Notify-NoReply app to send as the new address — because the app is scoped to this group's membership.

Step 4: Wait for propagation

Microsoft 365 needs time to apply the new group membership across Exchange Online. Allow up to ~60 minutes before the app can reliably send from the new address. During this window, sends from the new address may be rejected — that's expected.

Step 5: Verify and hand off

Once propagation has completed:

• Test a send — ask the developer/service owner to send a test notification from the new address, or run the verification in the PowerShell section below.
• Confirm the name — the test email should arrive showing your Display name from Step 1 (e.g. "New Employee(s)").
• Give the address to the service owner — they set the new sender address (e.g. newemployees@mckimcreed.com) as the "From" address in their application's configuration.

Done

The new notification address is live. Any message the service sends from it will display the name you configured, while all of it continues to route through the single Notify-NoReply app registration.

---

Doing the same thing with PowerShell

If you prefer PowerShell (or want to script adding several senders at once), the steps below accomplish exactly the same result as the manual walkthrough above.

1. Connect to Exchange Online

Install-Module ExchangeOnlineManagement -Scope CurrentUser   # first time only
Connect-ExchangeOnline -UserPrincipalName you@mckimcreed.com

2. Create the shared mailbox

Set -DisplayName to the name recipients should see, and -PrimarySmtpAddress to the new address.

New-Mailbox -Shared -Name "New Employee(s)" `
    -DisplayName "New Employee(s)" `
    -PrimarySmtpAddress newemployees@mckimcreed.com

3. Add it to the svc-notify-senders group

Add-DistributionGroupMember -Identity svc-notify-senders `
    -Member newemployees@mckimcreed.com

4. Verify the app can send as it

Allow ~60 minutes for propagation, then confirm the Notify-NoReply app is permitted to send as the new address. Replace with the Notify-NoReply Application (client) ID.

Test-ApplicationAccessPolicy -Identity newemployees@mckimcreed.com -AppId <client-id>
# Expect: AccessCheckResult = Granted

Adding several at once

$senders = @(
    @{ Name = "New Employee(s)";  Address = "newemployees@mckimcreed.com" }
    @{ Name = "RFQ Monkey";      Address = "noreply-rfq@mckimcreed.com" }
    @{ Name = "Purchase Orders"; Address = "noreply-po@mckimcreed.com"  }
)

foreach ($s in $senders) {
    New-Mailbox -Shared -Name $s.Name -DisplayName $s.Name -PrimarySmtpAddress $s.Address
    Add-DistributionGroupMember -Identity svc-notify-senders -Member $s.Address
}

---

Send the mail

The code below sends from the shared mailbox. Note the display name shown to recipients comes from the mailbox's DisplayName, not the Name you pass here — Exchange overwrites it (see Getting a different name per service if you need names to vary).

C# (Microsoft Graph, app-only — recommended)

// dotnet add package Azure.Identity
// dotnet add package Microsoft.Graph
var credential = new ClientSecretCredential(tenantId, clientId, clientSecret);
// Prefer CertificateCredential(tenantId, clientId, cert) in production
var graph = new GraphServiceClient(credential);

await graph.Users["noreply@mckimcreed.com"].SendMail.PostAsync(new()
{
    Message = new Message
    {
        From = new Recipient { EmailAddress = new()
            { Name = "New Employee(s)", Address = "noreply@mckimcreed.com" } },  // per-service name
        Subject = "Your estimate is ready",
        Body = new ItemBody { ContentType = BodyType.Html, Content = "<p>…</p>" },
        ToRecipients = [ new() { EmailAddress = new() { Address = "user@example.com" } } ]
    },
    SaveToSentItems = false
});

Config to store (Key Vault / env vars, never in code): TenantId, ClientId, ClientSecret-or-Cert, and the fixed sender noreply@mckimcreed.com. The display name is passed per call by each service.

PowerShell smoke test (Graph REST)

$tenantId = "<tenant-id>"; $clientId = "<client-id>"; $clientSecret = "<secret>"
$mailbox  = "noreply@mckimcreed.com"

$token = (Invoke-RestMethod -Method POST `
    -Uri "https://login.microsoftonline.com/$tenantId/oauth2/v2.0/token" `
    -Body @{ grant_type="client_credentials"; client_id=$clientId
             client_secret=$clientSecret; scope="https://graph.microsoft.com/.default" }).access_token

$payload = @{
    message = @{
        from    = @{ emailAddress = @{ name = "New Employee(s)"; address = $mailbox } }
        subject = "Test notification"
        body    = @{ contentType = "HTML"; content = "<p>Hello from noreply</p>" }
        toRecipients = @(@{ emailAddress = @{ address = "you@mckimcreed.com" } })
    }
    saveToSentItems = $false
} | ConvertTo-Json -Depth 6

Invoke-RestMethod -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/users/$mailbox/sendMail" `
    -Headers @{ Authorization = "Bearer $token" } `
    -ContentType "application/json" -Body $payload

A 202 Accepted (no body) means it sent.

Article Title Here

Brief description of what this article covers.

Step-by-Step Instructions

1. First step

1. Second step

Additional Notes

Any additional information or tips.