Limit Permissions to a Specific Mailbox
This document describes how to limit the permissions for an App Registration to a specific mailbox or a set of mailboxes.
Last updated
Was this helpful?
This document describes how to limit the permissions for an App Registration to a specific mailbox or a set of mailboxes.
Last updated
Was this helpful?
When you have created an App Registration with Mail.ReadWrite permissions it is possible to read all mailboxes in the directory. Follow these instructions to limit the access to mailboxes in a specific security group.
For more information about limiting the permissions to a specific mailbox, read more at
Navigate to Exchange Admin Center,
Create a new mail-enabled security group
Select "Mail-enabled security" for the group type
Enter a name for the group
Enter an email address
Save the new group
Add one or members to the new group by clicking on the Group Name and select Members in the panel to the right
Add the member and save
Follow these steps to connect your App Registration with the Mail-enabled Security Group by using Exchange Online PowerShell.
Execute the following statements in PowerShell console
First import the EchangeOnlineManagement module
Connect to EchangeOnlineManagement
Create the new access policy by connecting your Application ID your Security Group
Test your new policy with an email address that is a member of the group and one that's not
Sample output of an access policy test:
Disconnect from Exchange Online PowerShell
If you haven't used Exchange Online PowerShell before you need to set up your PowerShell environment first. Follow the instructions at
