DKIM spam issue when using application permissions

[supple phoenix]

We’re building a multi-tenant SaaS app where customers can integrate their Microsoft 365 tenant. Currently, we send emails on behalf of users using Microsoft Graph with Application permissions (ClientSecretCredential).
• When users send emails directly from Outlook, DKIM/DMARC alignment works fine because the emails go through their own tenant infrastructure.
• But when we send emails through Graph API with app-only auth, DKIM is missing . This causes emails to fail DMARC and land in spam.

So my question is:
• Is Delegated auth (user login) the only way to ensure DKIM alignment when sending via Graph?

We want to avoid rewriting our entire mail flow (we currently create drafts, upload attachments, etc. via Application auth). Ideally we’d like the simplest option that ensures DKIM is correct for the customer’s domain.

[supple phoenix]

Anyone? Please

[quaint locust]

Delegated auth is not the only way to get DKIM/DMARC alignment.
i think have each customer create a tenant mailbox for your service, enable DKIM for their domain, and create an Application Access Policy so your app (app-only) can send as that mailbox. That preserves your app-only workflow and gives tenant DKIM signing

[supple phoenix]

@quaint locust Thank you for your reply! I did some research into what you mean, asked GPT how the customer would be able to create such policy. Is this the way to go?

[quaint locust]

Yes. This is one way only, Another way which i believe should also work is that, you have them register the saas app in their tenant and it should help with spam email thing, And I'm sure there are more ways as well, these two initially pop to me.