CODEWITHSUNDEEP
azureoffice365microsoft-graph-apiazure-ad-graph-apiservice-application
Kaptein Babbalas
Kaptein Babbalas

Reputation: 1108

Limit access to groups or individual mailboxes using a service application in Azure Ad

I have an Azure integrated service application (daemon app) with permissions to the Microsoft graph api, I can now read all the mailboxes for the entire company, which is awesome but might raise some concerns with the business management. We use Outlook in Office 365.Is there a way to specify mailboxes that the app can have access to instead of having access to all mailboxes/users.

Upvotes: 3

Views: 1863

Answers (2)

Ren Rutgerg
Ren Rutgerg

Reputation: 51

This Microsoft doc appears to give the answer Scoping application permissions to specific Exchange Online mailboxes https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access

Administrators who want to limit the app access to a specific set of mailboxes can use the New-ApplicationAccessPolicy PowerShell cmdlet to configure access control. This article covers the basic steps to configure an application access policy.

Upvotes: 5

Fei Xue
Fei Xue

Reputation: 14649

The daemon app which use the client credential to acquire the access token.

The client credential flow is used to as an authorization grant typically when the client is acting on its own behalf. And it is not able to specify mailboxes that the app can have access.

You can achieve this by implement the business logic in the daemon app.

Upvotes: 1

Related Questions