Create Mailbox items using Graph and limit access to specific mailboxes

Question

I'm building an app that I would like to leverage to create mails in a mailbox in Exchange Online using this Graph API. How do I create an access token for it so that it can only action against specific mailbox? Would I create an app registration and grant certain API access then use an Exchange application restriction policy?

Answer 1

Yes, use an Exchange Application access policy and scope to the mailboxes you want to have access to
https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access

However:
This only works for specific scopes, so in your case, you prob cant use this if you want to create mail

Answer 2

So if I grant the application Mail.ReadWrite then as per here it should fall within that scope. Without the access restriction policy would the app have full access to all mailboxes as indicated by https://learn.microsoft.com/en-us/graph/auth-limit-mailbox-access which I find concerning! Security should be opt out not in!

That said, thank you for taking he time to reply. Very much appreciated.