CODEWITHSUNDEEP
microsoft-graph-apioffice365office365apimicrosoft-graph-calendar
Pascal R.
Pascal R.

Reputation: 2323

How to scope a specific Graph API permission to a specific user or mailbox

According to Microsoft Docs, there is a way to scope Graph API application permissions to specific users / mailboxes with a command like this:

New-ApplicationAccessPolicy -AppId e7e4dbfc-046f-4074-9b3b-2ae8f144f59b -PolicyScopeGroupId EvenUsers@contoso.com -AccessRight RestrictAccess -Description "Restrict this app to members of distribution group EvenUsers."

In this case, the application can use all its allowed application permissions (e.g. Mail.Send, Calendars.Read) on the members of the group EvenUsers.

But what if I want to scope a specific permission to a specific group? For example, the application is allowed to send mails as users in group X and is allowed to read the calendars of the users in group Y but not vice versa.

Is this possible?

Upvotes: 1

Views: 831

Answers (1)

Dev
Dev

Reputation: 2464

  • As far i know, its applicable to specific users or mailboxes; not heard for groups (see comment)
  • Still if you think you need such granular permissions consider filing an uservoice or upvote to the related ones, so Microsoft can consider implementing it. The closest uservoice i remember is this.

Upvotes: 1

Related Questions