How to Handle O365 Shared Mailboxes in CI/CD Test Automation

#playwright #testing #automation #devops

Testing email workflows—like OTP verification, password resets, or automated notifications—is a core requirement for robust end-to-end (E2E) automation.

However, automating Office 365 (O365) Shared Mailboxes via UI logins or legacy IMAP basic authentication is a nightmare. UI logins trigger MFA, IMAP basic auth is deprecated across Microsoft 365, and browser automation for Outlook web is notoriously flaky.

The enterprise-grade solution? Use Microsoft Graph API with Client Credentials (App-Only) Flow directly inside your automation framework.

Here is a step-by-step guide on how to set this up for your test automation pipelines.

Step 1: Azure AD (Entra ID) Configuration

To access a shared mailbox programmatically without interactive user logins or MFA:

Register an Application in the Azure Portal (Entra ID).
Under API Permissions, add Microsoft Graph permissions:

Mail.ReadWrite (Application Permission)
Mail.Send (Application Permission)

Grant Admin Consent for the permissions.
Generate a Client Secret (or upload a Certificate) under Certificates & secrets.
Save your Tenant ID, Client ID, and Client Secret securely in your environment variables.

💡 Security Best Practice: Restrict the app registration's access so it can only target the specific shared mailbox rather than all tenant mailboxes using an ApplicationAccessPolicy in Exchange Online PowerShell.

Step 2: Fetching OAuth 2.0 Tokens Programmatically

Before querying the mailbox, request a bearer token using the Azure AD token endpoint:

POST https://login.microsoftonline.com/{TENANT_ID}/oauth2/v2.0/token

Request Body (application/x-www-form-urlencoded):

client_id: {CLIENT_ID}
scope: https://graph.microsoft.com/.default
client_secret: {CLIENT_SECRET}
grant_type: client_credentials

Step 3: Querying the Shared Mailbox

Once you have the Bearer Token, make direct REST API requests targeting the shared mailbox email address:

1. Fetch Latest Unread Email (e.g., for OTP or Link Extraction)

GET [https://graph.microsoft.com/v1.0/users/shared-mailbox@yourdomain.com/messages?$filter=isRead](https://graph.microsoft.com/v1.0/users/shared-mailbox@yourdomain.com/messages?$filter=isRead) eq false&$top=1&$select=subject,body,receivedDateTime
Authorization: Bearer {YOUR_ACCESS_TOKEN}

2. Extract Links or Passcodes

Parse the returned JSON payload using Regex or HTML parsers to extract verification links, tokens, or body text directly in code—bypassing UI interaction completely.

3. Send Email via Shared Mailbox

POST [https://graph.microsoft.com/v1.0/users/shared-mailbox@yourdomain.com/sendMail](https://graph.microsoft.com/v1.0/users/shared-mailbox@yourdomain.com/sendMail)
Authorization: Bearer {YOUR_ACCESS_TOKEN}
Content-Type: application/json

{
  "message": {
    "subject": "Automated Test Notification",
    "body": {
      "contentType": "Text",
      "content": "Test run completed successfully."
    },
    "toRecipients": [
      {
        "emailAddress": {
          "address": "recipient@yourdomain.com"
        }
      }
    ]
  }
}

Why This Strategy Wins for CI/CD Pipelines

Fast & Reliable: Direct HTTP API execution takes milliseconds compared to seconds of UI navigation.
No MFA Blockers: App Credentials bypass multi-factor authentication seamlessly in headless Jenkins/GitHub Actions runs.
Flake-Free Execution: Zero UI flakiness from changing Outlook web interfaces or loading delays.

How are you currently handling email validations in your automation test suites? Let me know in the comments!

DEV Community