Best practice in setting up email to an ERP system for invoicing reasons

In Greece one of the most famous ERP apps build in c# is Pylon. The Pylon.gr (owned by Epsilon.net) has an Enterprise application in Azure named "Pylon.Office365". This app requires administrator's consent to send an email. Specifically the claim value of the administrator are:

• profile
• Mail.ReadBasic
• Mail.Read
• offline_access
• Mail.ReadWrite
• Mail.Send
• openid
• email

Imo these security permissions should be change to user consent.

In that way I should create a user with Cloud Application Administrator permissions, and use this email account to connect it to the ERP in order to send emails. It does not sound as best practice at all.

Also I was looking for the permission claim value: Mail.Send.As , in order for a user to be able to send an email on behalf of (or send as) of ******@___domain.com for example instead of ******@___domain.com.

Note that at the moment the requirement is that the ******@___domain.com should send an email as ******@___domain.com (which is not a use mailbox but it is a Microsoft 365 Group), which email will contains the invoicing data with an attachment usually.

I would like a Best practice tutorial how the ERPs should integrate Microsoft365 user accounts and especially have the ability to send in behalf of (send as).

Any other alternative is welcome, but not creating the ******@___domain.com as a normal user mailbox.

ty in advance