Limit application permissions to a tenant subset of rooms

Question

Our platform offers an integration to synchronize outlook rooms meetings from a 365 tenant. We allow our customers to map rooms from their tenant with our platform's rooms through an entra application, which requires admin consent permissions such as Place.Read.All, User.Read.All, Calendars.ReadWrite.

A new customer security policy requires to not expose all rooms in their tenant to external applications, the aforementioned permissions cannot be granted, is there a way read/write only on a subset of rooms (maybe manageable by a service account), without the tenant admin permissions?

Thank you

Answer 1

You can limit access via Application access policies, or the newly introduced RBAC for apps feature: https://techcommunity.microsoft.com/t5/exchange-team-blog/announcing-public-preview-of-role-based-access-control-for/ba-p/3688228

It allows you to scope access based on management scopes in Exchange, or Entra ID administrative units. Both can be scoped to include only a subset of the rooms, as needed. If you need a more detailed writeup on the method, I have one here: https://www.michev.info/blog/post/4282/exo-rbac-improvements-1-limiting-application-access

Answer 2

Hi Riccardo,

Thanks for posting this in Q&A.

Please let me know if you still have any questions.

Thanks