Graph app-only mode — no browser sign-in. Mail is sent via mail@zimaw.com using client credentials.
Azure: Application permission Microsoft Graph → Mail.Send (application, not delegated) + admin consent.
SMTP relay auth: username_sender — with username_sender, each legacy app uses SMTP AUTH username = full mailbox email (sender) and a shared password; MAIL FROM can be wrong or empty in the message.
Legacy apps submit mail to SMTP 0.0.0.0:2625 using relay credentials from env.