Feedback
Last date modified: 2026-Jul-24
Graph API for communications
Relativity Legal Hold uses Microsoft Graph API to send email communications from your Microsoft tenant. Microsoft Graph API supports two permission models:
Decide which model works best for your organization. Then learn how each model works with Relativity.
Permission types
Each permission type uses a different authentication model and has different tenant, licensing, and setup considerations. Understanding these differences helps you select the option that aligns with your organization’s environment and compliance requirements.
Application permissions
Graph API (Application) supports outgoing email only. To receive custodian replies in Relativity, you must set up a separate incoming email processor type. For more information, see Adding Incoming Email settings.
With Application permissions, Relativity sends Legal Hold email communications as an application.
- A Microsoft user does not need to sign in.
- Authentication occurs at the application level.
Microsoft sends emails from the mailbox you entered in the Email From field.
- This mailbox sends emails and receives replies, but Relativity does not pull those replies.
- You can view replies directly in Microsoft.
Relativity supports Application permissions for Commercial environments only. Government environments must use Delegated permissions.
For more information, see Microsoft Graph API - Application permissions.
Delegated permissions
With Delegated permissions, Relativity sends Legal Hold email communications on behalf of a signed‑in Microsoft user.
This permission type uses user‑based authentication and requires a licensed Microsoft user to sign in during setup.
Relativity supports Delegated permissions for both Commercial and Government environments, including GCC High.
For more information, see Microsoft Graph API - Delegated permissions.
Comparisons
The tables below summarizes the key differences between delegated and application permissions.
Authentication and behavior
View the authentication and behaviors for each permission type.
| Feature | Application permissions | Delegated permissions |
|---|---|---|
| Authentication model | Application‑based | User‑based (signed‑in user) |
| User sign‑in required | No | Yes |
| Credential prompt during setup | No | Yes |
| Emails sent from | Configured mailbox | Signed‑in user’s mailbox |
| Dependency on individual user account | No | Yes |
| Supported tenant types | Commercial only | Commercial and Government |
| Email processor types | Outgoing | Incoming and outgoing |
Licensing and mailbox requirements
View the licensing and mailbox requirements for each permission type.
| Requirement | Application permissions | Delegated permissions |
|---|---|---|
| Microsoft user required | No | Yes |
| License required | No | Yes |
| Minimum license | No license required | E3 (Commercial) or GCC High (Government) |
| Mailbox required | Valid user or shared mailbox | Licensed user mailbox |
Choose the correct permission type
Use the guidance below to choose the permission type applies to your environment:
- Use Delegated permissions if:
- You are a Government tenant, including GCC High.
- Your organization requires user‑based authentication.
- Must send email communications from a signed‑in user’s mailbox.
- Use Application permissions if:
- You are a Commercial tenant.
- You want a non‑interactive, application‑based configuration.
- You want to avoid dependency on individual user accounts for Legal Hold communications.
For configuration steps and detailed requirements, see:
Outbound connectivity
Connections to Microsoft Graph and Exchange Online use Microsoft‑managed cloud endpoints.
Microsoft does not provide static source IP addresses for these services, and Relativity cannot offer fixed IP ranges or CIDR blocks for allow‑listing.
Microsoft recommends using application‑ or service‑based access controls rather than IP‑based restrictions.
