How to restrict the access of MailBoxSettings.ReadWrite to only one MailBox instead of all MailBoxes in tenant.

Question

I am using Graph API to access the MailBox Rules in one of the email in our domain but currently the App has permission for MailBoxSettings.ReadWrite which can access the mailboxes of everyone in the domain since that is the default setting. I want to set it such that the App only has permission to edit the mailboxes in a security group or just one email address. I had tried using Exchange Online to set the Management Scope and Management Role through RBAC but I am still able to access other emails. The FAQ said it can only be constrained using Application Access Policy but it is a legacy function now.

Answer 1

Hello Cheng Kai Hoe,
Just to confirm first: Are you using application permissions (app-only) rather than delegated permissions? And is the target mailbox a user, shared, or service account? (These details help ensure the solution applies directly to your scenario.)
MailboxSettings.ReadWrite is an application permission, which by default allows access to all mailboxes in the tenant. Unfortunately, Exchange RBAC management scopes do not apply to Microsoft Graph app-only permissions this is why your RBAC attempt didn’t limit the access.

The only supported way to constrain Graph mailbox access is still Application Access Policies (AAP), even though Microsoft labels it as “legacy.” There is currently no modern replacement, and AAP remains fully supported.

How to Restrict Access

1. Create a Security Group for the allowed mailbox(es):

New-DistributionGroup -Name "GraphMailboxAccess" `
  -PrimarySmtpAddress ******@domain.com
Add-DistributionGroupMember -Identity "GraphMailboxAccess" `
  -Member ******@domain.com

1. Assign an Application Access Policy:

Connect-ExchangeOnline -UserPrincipalName ******@domain.com
New-ApplicationAccessPolicy -AppId <AppId_of_Azure_AD_App> `
  -PolicyScopeGroupId ******@domain.com `
  -AccessRight RestrictAccess `
  -Description "Restrict Graph app to specific mailbox"

1. Test the policy:

Test-ApplicationAccessPolicy -AppId <AppId_of_Azure_AD_App> `
  -Identity ******@domain.com

Result: The app can now only access the mailboxes in the GraphMailboxAccess group. Any attempt to access another mailbox will return 403 Forbidden.

Alternatives / Workarounds

• Use delegated permissions instead of application permissions if feasible (limits access to the signed-in user).
• Use separate service principals for different workloads.
• Monitor access using Microsoft Purview auditing.

Official Documentation

• Restrict application permissions to specific Exchange Online mailboxes
• MailboxSettings.ReadWrite permission reference
• New-ApplicationAccessPolicy
• Test-ApplicationAccessPolicy Hope this helps and points you in the right direction! If you have any further questions, please let us know. Thank you!