Azure Communication Services Email as an SMTP relay for a device or application

This is the path Microsoft recommends for Azure VMs: an authenticated SMTP relay on port 587, external recipients allowed, paid per message. About $1 a month for 3,000 mails. The price is a username, a client secret and TLS 1.2 on the device, plus one afternoon in the Azure portal.

Does ACS Email fit your case?

Recipients	Internal and external.
Works from Azure or any host	Yes. Port 587 is not blocked anywhere in Azure, whatever the subscription type.
Device needs TLS	Yes. "Your device must be able to use TLS version 1.2 and above."
Device needs a login	Yes. An SMTP username and the client secret of an Entra application as password.
Sender address	An address on a domain verified in ACS, either the Azure-managed `*.azurecomm.net` domain or your own subdomain. Not your Microsoft 365 mailbox.
Sent Items in Microsoft 365	No. Mail does not pass through Exchange Online.
Cost	$0.00025 per message plus $0.00012 per MB. Microsoft's example: 3,000 mails of 1 MB a month = $0.75 + $0.36.
Secret lifetime	Client secrets expire, 24 months at most. Plan the rotation or the device stops sending.

Step 1. Create the Email Communication Service and a domain

Azure portal → Create a resource → Email Communication Services. Pick a resource group and a data location.
In the new resource open Provision domains. Two choices:
- Azure managed domain. One click, ready in minutes, sender likeDoNotReply@a1b2c3d4-….azurecomm.net. Fine for alerts to your own staff. Limited to 100 mails per hour and 1,000 recipients a day by default.
- Custom domain. Use a subdomain, for example notify.contoso.com, not the domain of your mailboxes. Add the TXT record for verification, then the SPF and two DKIM CNAME records that the portal shows. Verification can take up to an hour.
Under MailFrom addresses add the sender you want, for examplescanner@notify.contoso.com.

Step 2. Create a Communication Services resource and connect the domain

Create a resource → Communication Services, same resource group.
In it, Email → Domains → Connect domain, select the domain from step 1.

The SMTP endpoint belongs to this second resource, not to the Email Communication Service.

Step 3. Register an Entra application for the device

Entra admin center → App registrations → New registration. Name it after the device, for example smtp-scanner-hq. No redirect URI.
Certificates & secrets → New client secret. Copy the value now; it is the SMTP password and is shown once.
Note the expiry date in your calendar.

Step 4. Give the application a role on the Communication Services resource

In the Communication Services resource open Access control (IAM) → Add role assignment. The built-in role is Communication and Email Service Owner. Assign it to the application from step 3.

That role is wide. For a device, a custom role with only these three permissions is enough:

Microsoft.Communication/CommunicationServices/Read
Microsoft.Communication/CommunicationServices/Write
Microsoft.Communication/EmailServices/Write

Clone the Reader role, add the three permissions, assign the new role instead.

Step 5. Create the SMTP username

Communication Services resource → SMTP Usernames → Add SMTP Username. Select the application from step 3 and type a username. It can be free text or an address on the connected domain. Wait for the status Ready to use.

Note the long form, which some portals show and which also works as the username:<communication resource name>.<app id>.<tenant id>. If the application does not appear in the drop-down, the role from step 4 has not propagated yet.

Step 6. Configure the device

Setting	Value
SMTP server or smart host	`smtp.azurecomm.net`
Port	587, or 25 if the device cannot change it
TLS or STARTTLS	Enabled, TLS 1.2 or 1.3
Username	The SMTP username from step 5
Password	The client secret value from step 3
From address	A MailFrom address on the ACS domain, for example `scanner@notify.contoso.com`

Step 7. Test and read the errors

Symptom	Cause
`535 5.7.3 Authentication unsuccessful`	Secret pasted with spaces, secret expired, or SMTP username not Ready to use.
`550 5.7.1` sender rejected	The From address is not a MailFrom address on a connected domain.
Mail accepted, never arrives	Custom domain without SPF or DKIM, or the Azure-managed domain hit its hourly limit. Check Insights in the Communication Services resource.
Device cannot connect	No TLS 1.2 on the device, or it only offers implicit TLS on 465. ACS uses STARTTLS on 587 and 25.
Everything stopped on one day	The client secret expired. Step 3, then update the device.

What changes compared with mail from a Microsoft 365 mailbox

Mail is sent from the ACS domain, with its own SPF and DKIM. Replies go wherever the device sets Reply-To.
Nothing appears in any Microsoft 365 mailbox. Audit and retention happen in Azure, through the ACS logs.
Delivery reports, bounces and tracking are in the Azure portal, not in Exchange message trace.
The Azure subscription is billed. Someone must own the subscription and the secret rotation.

When ACS Email cannot work

The device cannot do TLS 1.2 or cannot authenticate with a username and password. This covers many scanners and most applications from before 2016.
The mail must come from a Microsoft 365 mailbox, with Sent Items, mailbox retention or eDiscovery covering it.
No Azure subscription allowed in your organisation.

For internal recipients the cheaper Microsoft path is High Volume Email. For a device that cannot log in, with a static IP, therelay connector. For a device that cannot log in and has no static IP, SMTP Bridge.

Sources: Microsoft Learn, Set up SMTP authentication for sending emails(updated September 2026), Email pricing, andTroubleshoot outbound SMTP connectivity in Azure (updated July 2026).