Microsoft GRAPH api - restrict user access

Question

I have created a azure APP and I have given "Mail.ReadBasic.All" to this APP. With this we can access metadata for all mailboxes. I want to restrict this access to only one email address. Basically REST call only allowing metadata to be retrieved for only one target email.

Answer 1

You have 2 options:

• Implement Get access on behalf of a user and the app will only access the signed-in user's mailbox and any other mailboxes the user have access to.
• If you are using Get access without a user, you could use New-ApplicationAccessPolicy to restrict your app to target mailboxes. For example: New-ApplicationAccessPolicy -AccessRight RestrictAccess -AppId "{appID}" -PolicyScopeGroupId EvenUsers@AppPolicyTest2.com -Description "Restrict this app to members of security group EvenUsers."

See a similar issue here.