The lane map (verified 2026 state)
| Pipe | For | Mechanics | Money |
|---|---|---|---|
| Graph sendMail | App transactional mail as a user/mailbox | App registration + Mail.Send (scope it with ApplicationAccessPolicy — security module) | Included |
| HVE (GA) | INTERNAL bulk: HR comms, IT notices, statements | HVE accounts, SMTP submission at scale, mailbox-plan-free ceilings | Billed per recipient beyond included tiers (~$42/M, from Jun 2026) |
| ACS Email | EXTERNAL application mail | Azure resource, its own verified domains + DKIM, REST/SMTP | Azure consumption (what serv365's own digest uses) |
| OAuth SMTP submission | Legacy apps that can OAuth | Port 587 with modern auth | Included |
| On-prem relay | The hopeless hardware | Local relay → connector | Your ops |
The 2026 fact that reshaped plans: HVE went internal-only — external sending was removed from its scope; external app mail belongs to ACS (or a specialist ESP under the bulk-compliance concept's rules). Estates that piloted HVE-for-newsletters must re-lane.
Choosing in practice (the flowchart)
External recipients? → ACS/ESP (with its own domain + full auth trio). Internal, high volume? → HVE (mind the per-recipient meter — 'free internal mail' now has a price signal, which will quietly improve comms discipline). Low-volume transactional as a mailbox? → Graph, scoped tightly. Device can't do any of it? → relay, on the shortest leash (connectors concept).
What to watch (proofs)
- The census-to-lane mapping: every sender from the SMTP-AUTH census (retirements concept) tagged with its target lane + migration ticket — the programme artifact.
- HVE consumption: the recipient-count reports against the billing meters — the June-2026-onward invoice line, forecast monthly.
- ACS health: its domain auth state (SPF/DKIM per the trio) and send metrics — serv365's own digest pipeline is this exact pattern; our delivery telemetry doubles as the reference implementation.
- Scope proofs on Graph senders: ApplicationAccessPolicy tests — the app can send as the intended mailboxes and NOTHING else (security module's test, applied per app).