Trying to understand what access this app gives

Question

Trying to understand what access this app gives

Adminuser 0

I have a request for the 1-1_Scheduler app in enterprise apps. The description does not indicate very clearly if this app gives access to all email? or just the user email? Can anyone respond on this?

Sridevi Machavarapu 33,565 Reputation points Microsoft External Staff Moderator

2026-06-05T12:25:19.44+00:00
Hello Adminuser,

Hey! I understand the confusion—an enterprise app’s description in the Entra admin center usually doesn’t spell out exactly what data (like “all mail”) the app can access.

That said, from the information provided in the relevant documentation, Microsoft Entra doesn’t determine “email access” from the app description alone. Access is controlled by the app’s configured permission scopes and by your tenant’s assignment/consent model, plus whatever the application itself does once it has those permissions.

Here are the practical points you can share:

How users get access to the enterprise app

If user assignment is required, then only users/groups you assign to the app can sign in and access it.

If user assignment isn’t required, unassigned users won’t see the app in My Apps, but they can still sometimes sign in via SP-initiated sign-on or using the app’s User Access URL (IDP-initiated sign-in).

How permissions translate into what data the app can access

The app’s ability to access resources (for example, whether it can read a user’s mailbox vs other users’ mail) comes from what permissions/scopes are configured and consented.

So you need to review the API permissions that were granted to that enterprise app/service principal (and whether admin consent was granted), rather than relying on the description.

What to check for the 1-1_Scheduler enterprise app

In the Entra portal for that enterprise app:

User assignment requirement

Confirm whether the app requires assignment and who (or which groups) are assigned.

Permissions granted

Review the app’s configured API permissions and whether admin consent was granted.

Then map permissions to mail access

Determine whether the granted permissions are scoped to:

only the signed-in user, or

broader mail scopes (which would imply access beyond just the signed-in user)

This mapping depends on the exact Microsoft APIs/scopes granted, not the app description.

Because your question is specifically “all email vs just the user email,” the documentation you provided doesn’t include the actual permission details for the 1-1_Scheduler app—so we can’t definitively answer from here.

Follow-up questions (to confirm the exact mail scope)

In Entra, what API permissions are listed for the 1-1_Scheduler enterprise app (and are they delegated or application permissions)?

Was tenant-wide admin consent granted for those permissions?

Is “Require user assignment” enabled for that enterprise app?

Are you trying to determine access to Microsoft 365/Exchange mailbox data specifically, or “email” in a different sense (like an app-managed notification email)?

References (from the provided documentation)

Manage access to an application (assignment behavior, My Apps visibility, SP-initiated/IDP-initiated sign-in): https://learn.microsoft.com/entra/identity/enterprise-apps/what-is-access-management

Authentication and authorization / Developing apps with Microsoft Entra ID (permissions/consent-related guidance links): https://docs.microsoft.com/azure/active-directory/develop/consent-framework

What is Microsoft Entra? (overview of Microsoft Entra ID and related capabilities): https://learn.microsoft.com/entra/fundamentals/what-is-entra

Note: This content was drafted with the help of an AI system.
Sridevi Machavarapu 33,565 Reputation points Microsoft External Staff Moderator

2026-06-08T11:12:35.6733333+00:00

Hello Adminuser,

Please confirm if you still have further queries on this

1 answer

Your answer

Sridevi Machavarapu 33,565 Reputation points Microsoft External Staff Moderator

2026-06-08T11:12:35.6733333+00:00

Hello Adminuser,

Please confirm if you still have further queries on this

Answer 1

The context provided does not contain any information about a "1-1_Scheduler" enterprise application or its permissions, so it is not possible to determine from this data whether it accesses all mailboxes or only the signed-in user’s mailbox.

References:

Trying to understand what access this app gives

What to check for the 1-1_Scheduler enterprise app

Follow-up questions (to confirm the exact mail scope)

References (from the provided documentation)

1 answer

Your answer