Email using Microsoft Graph API instead of Mailgun

Currently Gorelo is sending emails using Mailgun. Ok, nothing is wrong with this, but it means that emails are being sent outside of our ecosystem, which among other things, pulls it out of our security remit.

If we are monitoring our help mailbox for anomolous emails outbound at strange hours, we cannot do this now. If we want to set some mail flow rules that say between 7pm and 7am don’t allow emails to send to anyone other that [whitelisted domains]…. we cannot set such rules. if we want to monitor the outgoing flow of tickets by polling the graph API and making sure that ticket emails are actually firing off as expected, we cannot do this now.

On top of this, Mailgun is another third party that we have to whitelist with DKIM and SPF to allow to send. Again it’s not bad what is happening, but I feel it is unecessary and doesn’t need to happen. I come from a system where we just signed the PSA into MSFT Graph, and all emails were done through the graph API, keeping the security posture (conditional accesss etc.) all within our MSFT environment, including the aforementioned observability.

I hope I make sense, surprisingly English is my first language, and I still suck at it.