Exchange.ManageAsApp
— application permission, granted to the app registration with admin consent.
Endpoints:
Get-AcceptedDomain · Get-DkimSigningConfig · Resolve-DnsName TXT / MX (on the host)
Recommended end state: one SPF record ending in -all or ~all, DKIM enabled in Exchange Online, DMARC p=quarantine or p=reject.
If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.
Email Authentication per Domain (SPF / DKIM / DMARC)
Large mailbox providers reject or junk mail from domains without SPF, DKIM and an enforced DMARC policy - and without them anyone can send mail that appears to come from your domain. One row per accepted domain, including domains you never send from (they need 'v=spf1 -all' and p=reject to stop spoofing).