Share via

Microsoft Graph Application Permission Limit access

Jiahao Wu 20 Reputation points
2025-01-30T12:20:03.1466667+00:00

I have a web application that uses Delegated Permissions to query Mail, but it does not fit our use-case which a tenant-wide Application Permission does. Now we need to limit permissions of Mailboxes & Calendars API, is there a way to restrict this Application Permission to a Microsoft Entra Group of Users/Shared Mailboxes?

Microsoft Security | Microsoft Graph
0 comments
Answer accepted by question author
  1. Andy David - MVP 160.2K Reputation points MVP Volunteer Moderator
    2025-01-30T12:23:49.77+00:00

    yes, you can follow:

    https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac

    I use this all the time and works great.

    2 people found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Rajat Vashistha-MSFT 1,780 Reputation points Microsoft External Staff
    2025-01-30T12:31:18.7233333+00:00

    Hi Jiahao Wu,

    Thank you for reaching out to Microsoft!

    Graph API can work either on delegated permission or Application-level permissions. However, you can limit application permissions to a specific group/Users by creating a New-ApplicationAccessPolicy.

    For more information, please refer to the following documentation: Limiting application permissions to specific Exchange Online mailboxes

    Hope this helps.

    If the answer is helpful, please click Accept Answer and kindly upvote it. If you have any further questions about this answer, please click Comment.

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.