CODEWITHSUNDEEP
azure-active-directorymicrosoft-graph-apioffice365
POSH Guy
POSH Guy

Reputation: 2048

Azure AD application permission with scopping

As per the below article, we can scope AzureAD Graph API permission from Exchange online.

https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access

We've assigned the following permission in AzureAD. However Calendars.ReadWrite "Application permission" is scoped for only a room mailbox account. So that application will only able to read/write room mailbox calendar.

enter image description here

Could someone please answer the below question?

I am not a member of the Scoping group and if I use the application token, will I be able to access my Calendar (Please note that calendars.ReadWrite.Shared delegated permission already granted in AzureAD)

Upvotes: 0

Views: 104

Answers (1)

Allen Wu
Allen Wu

Reputation: 16438

No, in the case that you use application token, and you are not in the scoping group, the application won't be able to access your Calendar.

calendars.ReadWrite.Shared delegated permission doesn't take effect on client credential flow. It only takes effect when you use user token (auth code flow) rather than application token (client credential flow).

Upvotes: 1

Related Questions