Due to the upcoming Basic Authentication Deprecation in Exchange Online – deadline of 10/1/22 , we have been working to change our web based ticket system (we were using basic authentication via IMAP) to use IMAP 4 with auth 2.0 authentication. We created an app using this link as a reference
Microsoft Graph Security API
A Microsoft API that provides a unified interface to connect security solutions from multiple Microsoft and third-party providers.
112 questions
The steps you have followed apply to the client credentials flow (application permissions), whereas your registered app is using delegate permissions. You are likely able to access other mailboxes because the user in which context you're running the app has the necessary Full access permissions.
As to the second question, IMAP is an outdated protocol and I wouldn't recommend using it. For integrating Exchange Online with other systems use the Graph API: https://learn.microsoft.com/en-us/graph/api/resources/mail-api-overview?view=graph-rest-1.0
You other question is around the same issue - you're trying to implement application access policies for unsupported scenario. They only work for Application permissions (as in, you get a token in the context of an application, via client secret or certificate). Instead, you're using the Delegate permissions model. To understand the difference between the two, read here: https://learn.microsoft.com/en-us/azure/active-directory/develop/permissions-consent-overview#types-of-permissions
Here's an article that explains for which scenarios application access policies apply: https://practical365.com/application-access-policies-in-exchange-online/
So i would i use delegate permissions model to achieve my goal of restricting access to only 1 mailbox? Where do i set this permission?
You can use either. The difference is that when using the delegate permissions model, your application will only have access to resources to which the user (under whose credentials the app runs) has access. Thus if you run under a user that has access to only his own mailbox, the application will not be able to access anything else. If you run under a user that has been granted access to other mailboxes, the application will be able to access them as well, and application access policies will not prevent this from happening.
When running in the application context model, there is no user involved and the application by default gets access to all resources in the org. This is where application access policies come into play - you can use them to restrict access to specific mailboxes only. Creating a service principal in ExO and granting Full mailboxes permissions achieves a similar purpose for POP/IMAP access.
Based one what you wrote it seems that the delegate permissions module is what I'm looking for since i only want to give 1 user access to its own email box.
when you say
user (under whose credentials the app runs)
Which setting are you referring to?
is it the owners setting? or user and groups setting under enterprise applications?
Sign in to comment