Ensuring Seamless Alert Delivery in Microsoft 365

Introduction: Why Alert Configuration Matters

Effective communication is essential in business—especially when it comes to system notifications and alerts. For teams relying on Infowise Ultimate Forms to generate alerts in SharePoint and across Microsoft 365, a little setup goes a long way. Proper configuration ensures that alerts are sent reliably, securely, and with the right level of control. Here’s a breakdown of how to configure alert emailing within Microsoft 365 using the Infowise Ultimate Forms.

Starting October 31, 2025: A Key Permission Becomes Mandatory

Up until now SharePoint API contained a simple and useful method of sending emails. By simply providing recipients, subject and body, you could send emails to anyone within your organization without even having configure any email settings. Ultimate Forms used this method to deliver alerts with reduced capabilities as a fallback method. For instance, we use this method when Exchange Online access is not available due to lack of permissions. The following limitations apply when falling back to this API:

• No ability to send to external recipients

• No option to attach files

• Emails originate from a generic, non-customizable sender address no-reply@sharepointonline.com

API Removal

As of October 31, 2025, Microsoft is removing this API. This means that Ultimate Forms will only be able to send emails via real Exchange Online mailboxes. You must explicitly grant permissions to send emails using users' mailboxes. Without granting these permissions, alerts will no longer be delivered.

Basically, to maintain full functionality, Exchange Online access must be explicitly allowed. The good news is that administrators can configure this in one step via the Alerts → Administration tab or under Global Settings → Alerts in the app. The difference between the two is the scope. Global settings apply to the whole tenant, whereas the non-global adminstration settings apply to the current site collection only. Note that the permission grants however are always global. No matter where you grant the permission, it will apply everywhere within the tenant.

Application vs. Delegated Permissions: Which Approach Is Best?

Infowise Ultimate Forms supports two ways of granting access to Exchange Online:

1. Application Permissions (default)

• Configured once per tenant by a Global Administrator

• Allows the app to send as any user in the tenant. The actual sender is always restricted to alert creator and Authorized senders.

• No need to renew unless manually revoked

• Easy to maintain—suitable for centralized alert management

2. Delegated Permissions

• Requires consent at the mailbox level

• Only allows sending through individual mailboxes where consent is granted

• Offers more granular control but can be tedious to configure for many users

• Expires for each user when unused for more than 90 days

The application-level approach is enabled by default. Ultimate Forms has built-in logic to fall back gracefully from delegated permissions. When sending an alert with delegated permissions chosen at site collection or global level:

1. The system first attempts a delegated token.

2. If that fails (e.g., no consent yet), it uses the application token to avoid interruptions.

3. If application consent is not granted, alert fails and an error is entered into the alerts log (if enabled).

This design allows administrators to phase in mailbox-specific permissions over time while keeping things running smoothly in the interim. Once all required consents are in place, application permissions can be revoked via Entra ID.

User Consent

A Global Administrator can allow users to grant consent to Ultimate Forms to send via their own mailboxes themselves. When a user creates an alert under delegated permissions, the app will check if it's allowed to send via the user's mailbox. If not, it will display a permission grant pop-up. If your organization allows user consents for Mail.Send and Mail.ReadWrite permissions, they can proceed to granting these permissions. Otherwise they will be asked to send a request to an administrator. Read more about user consent in this documentation article.

Note that these Send Email permissions are also used by Send Email and Print List Items actions.

Setting the From Address: Who’s Sending Your Alerts?

By default, Infowise Ultimate Forms alerts send from the alert creator’s mailbox. But often, organizations prefer to have alerts come from shared or neutral addresses like alerts@yourcompany.com. Here’s how:

• Go to Alerts → Administration or Global Settings -> Alerts

• Enable "Allow changes to sender"

• Specify a list of Authorized Senders (must be valid Exchange mailboxes; distribution lists or shared mailboxes don't work)

• Users can then select from these approved mailboxes when configuring alerts

• You can also optionally force Authorized senders only by removing the option to select user's own mailbox

Note that global tenant settings can override site collection settings, making it simple to enforce or restrict custom sender addresses across the organization.

Guarding Access: Security Trimming for Alerts

To protect sensitive items, Infowise Ultimate Forms includes a security-trimming feature:

• For each alert recipient, the system checks if they have at least Read access to the item generating the alert.

• Recipients without access are automatically removed from the alert distribution list.

• Note: for veteran customers the app might not be allowed to check membership of Entra ID (formerly Azure AD) groups. In this case, you must grant the app permission to query group membership via the Alerts → Administration settings.

Security trimming can be toggled off at either the site or tenant level for organizations with a more open-sharing approach or performance considerations. Note that even when security trimming is turned off, users won't be able to access items via links from alerts without the necessary permissions.

Summary Table: Feature Capabilities

Why This Configuration Matters

1. Reliability: Application permissions ensure continuous alert delivery even before all mailbox-level consents are obtained.

2. Customization: Authorized sender settings enable alerts to come from brand-appropriate addresses.

3. Security: Access checks ensure sensitive items aren’t sent to the wrong people.

4. Compliance: The permissions model aligns with rising security standards in Microsoft 365 environments.

Recommended Approach for IT Admins

Getting Started:

• Head to Global Settings or Alerts → Administration in the Ultimate Forms app

• Grant necessary Exchange Online Email Send permissions before Oct 31, 2025

Choose Permission Mode:

• Default: Use Application Permissions for simplicity.

• Optional: Use Delegated Permissions for individual control.

Configure Sender Options:

• Enable Authorized Senders for teams or functional mailboxes

• Standardize full mailbox lists at the tenant level

Harden Security:

• Enable Security Trimming for maximum data protection

• Ensure Entra ID access is granted. One option is to grant it under Alerts -> Administration. Alternatively, you can grant Directory.Read.All access for Infowise Ultimate Forms Data Access enterprise app in Entra ID.

Monitor & Iterate:

• Track alert failures or access issues

• Tweak authority and security settings as needed over time

Permissions Beyond Alerts

The application vs delegated permission grant distinctions is not limited to sending emails via alerts. The same approach is used by both Import and Actions. These components require permission grants to read emails, create calendar events or working with Teams.

Conclusion: Make Alerts Seamless, Secure, and Powerful

Alerts are only as valuable as they are deliverable, relevant, and secure. Infowise Ultimate Forms delivers reliable alerts—across internal and external recipients, attached content, and customizable sender addresses—provided your configuration is correctly set up.

Granting access via application permissions, defining authorized sender lists, and enabling security trimming are essential steps. Once in place, your organization benefits from stronger alerting capability, better governance, and a smoother experience.