Drift emails
Maester Cloud emails your team when runs finish: the headline counts, what changed since the previous run, and the regressed tests with severity and product, linking back to the portal's Changes page. Everything is still recorded in the portal whether or not an email goes out.
Recipients and cadence
Choose recipients and cadence in the portal under Settings → Email reports. Recipients are the same for every connected tenant; past a handful of people, point it at a distribution list.
| Cadence | What you get |
|---|---|
| After every run | One report per tenant as each run finishes, with what changed since the previous one. |
| Daily summary | One message a day, at a time you choose, covering every connected tenant. |
| Off | Nothing is sent on a schedule. The test send still works. |
Turn on Only email when a run regresses to stay quiet on clean runs. The same page has a Send a test email button that sends one message, with no customer data, down exactly the path a report takes.
Sent from your mailbox, with no secrets
Emails come from one shared mailbox in your tenant (for example
[email protected]), so they stay inside your
compliance boundary and your recipients trust the sender. Shared mailboxes
need no licence.
The sender is your deployment's own managed identity. There is no app registration, client secret, or certificate for mail, so there is nothing to store, leak, or rotate.
Scoped to one mailbox
The managed identity is authorised through Exchange Online RBAC for
Applications: the Application Mail.Send role, restricted by
a management scope that holds exactly one mailbox. It can send as that
mailbox and no other.
Mail.Send is never granted in Microsoft Entra, not to
the managed identity, the portal sign-in app, or the runner. Entra and
Exchange permissions add up rather than intersect, so a single Entra grant
would silently widen sending back to every mailbox in your tenant.
Setting it up
- The setup wizard's Email step does it in one go: it creates the shared mailbox (or uses an existing one), registers the managed identity in Exchange, and assigns the scoped send role. It needs an Exchange Administrator, and it is skippable and safe to re-run.
- If you skip it, Settings → Email reports in the portal has a Set up manually section: admin-center links to create the mailbox, and a generated PowerShell script to grant the scoped role, run as an Exchange Administrator. Press Mark as done, then send a test email to prove it.
- Add recipients, pick a cadence, and send a test email.
The portal itself holds no Exchange permission. It shows the grant status, sends test emails, and edits recipients and cadence. To change the sender mailbox, re-run the wizard's Email step.