Configure Email Notifications

App Store for Intune can send email notifications from a mailbox you choose. Requestors hear when a request is submitted, approved, rejected or installed. Approvers hear when a request needs their decision. Administrators hear about published apps, app suggestions, Group Automation events and available app updates.

Prerequisites

1. The Mail.Send permission on the App Service’s managed identity. It is granted during setup by the Grant Microsoft Graph permissions step, so it is normally already in place.
2. A mailbox to send from. A shared mailbox works well: it needs no license and no one signs in to it. For example, create one named App Store for Intune with the address appstore-noreply@contoso.com in the Exchange admin center or the Microsoft 365 admin center.

Confirm Mail.Send Is Granted

1. In the Azure portal, go to Microsoft Entra ID > Enterprise applications.
2. Set the Application type filter to Managed Identities, and select your App Service by name.
3. Select Permissions, and check that Mail.Send is listed.

If it isn’t, rerun the Grant Microsoft Graph permissions snippet. It skips permissions that are already granted, and Mail.Send is in its list.

Turn On Email Notifications

1. In App Store for Intune, select Admin. In the left menu, under Store Administration, select Communications.
2. Under Email Notifications, select Enable email notifications.
3. In Send As User, enter part of the mailbox’s name, and select the mailbox in the results. From Address fills in with the mailbox’s own address. Email always comes from the Send As User mailbox.
4. In Portal URL, enter your App Store for Intune address, for example https://appstore.contoso.com. Links in emails use it.
5. Under Email Events, select the events that send email.
6. Select Save Settings.

Tip

A shared mailbox you just created can take a few minutes to appear in the Send As User search.

What Gets Emailed

Email	Who Gets It	Setting
App Request Submitted	The requestor	Notify requestor when request is submitted
Approval Required	The approvers of the request’s current stage	Notify approvers when approval is required
App Request Approved	The requestor	Notify requestor when request is approved
App Request Rejected	The requestor, with the reason	Notify requestor when request is rejected
App Installed	The requestor	Notify requestor when app is installed
App Published	The administrator who published the app	Notify admin when app is published to Intune
Approval reminders	The approvers of the request’s current stage	Approval Reminders on Communications
Escalations	Your escalation recipients	Stale Request Escalation on Communications
App suggestions	The App Store administrators	Sent when a user suggests an app
Group Automation	The App Store administrators and the administrator who created the automation	Group Automation Notifications on Communications
App update notifications	The App Store administrators	Send Email Notifications for Updates under Apps > App Updates

The App Store administrators are the members of the Admin Group and the administrator who deployed App Store for Intune. Times in emails are in UTC.

Set It Up in appsettings.json Instead

You can also set the sender in the App Service configuration. Settings saved on Communications take precedence over these values.

{
  "EmailSettings": {
    "SendAsUserId": "mailbox-object-id",
    "FromAddress": "appstore-noreply@contoso.com",
    "PortalUrl": "https://appstore.contoso.com"
  }
}

Setting	Description
SendAsUserId	The Object ID of the mailbox to send from. To find it, go to the Azure portal > Microsoft Entra ID > Users, select the mailbox, and copy Object ID from its Overview page. If empty, email notifications are off.
FromAddress	The mailbox’s own address.
PortalUrl	Your App Store for Intune address, used for links in emails.

Test Email Notifications

1. Submit an app request.
2. Check that the requestor gets an App Request Submitted email.
3. Check that the approvers get an Approval Required email, and that its Review Request link opens the request on the Approvals page.
4. Approve or reject the request, and check that the requestor gets the result.

Troubleshooting Email Issues

• 403 Forbidden: The App Service managed identity doesn’t have Mail.Send. Rerun the grant snippet.
• The mailbox doesn’t appear in Send As User: Wait a few minutes after creating it, and search by its display name.
• Email not sent: Check the App Service logs for the error.

Next Step

Continue to Configure Microsoft Teams Bot (optional).