Working with ApplicationAccessPolicy

Question

Working with ApplicationAccessPolicy

Han Tang 20

Hi,

I am working on setting an ApplicationAccessPolicy to limit the API access to a single mailbox. I am trying to see what policy already exist so I ran Get-ApplicationAccessPolicy and it return me an error message.

Ex6F9304|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|The operation couldn't be performed because object 'OU=<domain>.onmicrosoft.com,OU=Microsoft Exchange Hosted Organizations,DC=CANPR02B022,DC=PROD,DC=OUTLOOK,DC=COM*' couldn't be found on 'YT1PR01A21DC002.CANPR02B022.PROD.OUTLOOK.COM'.

I ran Get-OrganizationUnit cmdlet and it shows the DistinguishedName and OriginatingServer matches what it says it can't find.

Can anyone let me know why server throw me the error?

Thanks,

HT

Accepted answer

1 additional answer

Your answer

Answer 1

Kael Yao 37,746 Moderator

Hi @Han Tang,

This error message may indicate currently there are no application access policies in your tenant.

I tested in my tenant and it returns the same error.

You can also refer to the discussion here: EXOApplicationAccessPolicy “Object couldn’t be found on the child domain.”

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Han Tang 20 Reputation points

2023-05-10T17:18:58.4266667+00:00

Hi Kael,

You are correct on why I get the error. It seems there is no ApplicationAccessPolicy, caused the get request return an error instead or saying there is no policies... I created a dummy policy and the Get-applicationaccesspolicy returned value correctly.

Thanks,

Han

Answer 2

Andy David - MVP 157.8K MVP Volunteer Moderator

instead of using ApplicationAccessPolicy, I would move to the newer RBAC which will replace it;

https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-public-preview-of-role-based-access-control-for/ba-p/3688228

Han Tang 20 Reputation points

2023-05-10T17:21:39.8133333+00:00

Hi Andy,

Thank you for the suggestion. I will look into the RBAC setup see if RBAC setup works for this particular request from the SAAS provider. I will come back to let you know the result.

Thanks,

Han
Han Tang 20 Reputation points

2023-05-12T01:17:59.85+00:00

Hi Andy,

The RBAC works as well! It just took me quite a while to get my head wrap around it. The concept is easy but setting the management scope really took me a long time.

Our account is AD Synced so I can't directly adding attribute to the Mailuser. It is difficult to get a attribute to make a filter will capture the mailboxes I intend to grant the permission to. Also you can't seems to check the resource/mailbox Management Scope actually captures. That really is really a PAIN to verify the management scope configuration result. I haven't found how to verify the scope other then actually finish configuring Management Role Assignment.

I hope Microsoft add a way to verify the scope before go to the role assign part.

Once again thank you for mentioning this so I don't have make this switch one or two year down the road.

Cheers,

Han

Share via

Working with ApplicationAccessPolicy

1 additional answer

Your answer