Only connections to the SMTP relay port from these addresses are accepted. Supports single IPs and CIDR ranges (e.g. 10.10.4.15 or 10.10.0.0/24) — useful for whitelisting printer/scanner subnets.
Relayed mail is authenticated to smtp.office365.com via client-credentials OAuth using the app's SMTP.SendAsApp permission, then submitted as normal SMTP — attachments and formatting from the original message (e.g. printer scans) are preserved.
This mailbox must be permitted for the app via an Exchange Application Access Policy.
Recommended on — printers/scanners rarely send a From address the tenant will accept for this identity.