Scope application access to mailboxes with RBAC for Applications

Description

Applications that use application permissions on mailbox data (Microsoft Graph Mail.*, MailboxSettings.*, Calendars.*, Contacts.*, or Exchange full_access_as_app) get them through RBAC for Applications in Exchange Online, limited to the mailboxes they need by a management scope or administrative unit, and no longer through a tenant-wide grant in Microsoft Entra ID.

Older application access policies (New-ApplicationAccessPolicy) are acceptable while they are migrated, provided every such application is restricted to a group.

Rationale

Tenant-wide mail permissions turn one application secret into a key to every mailbox, and attackers look for exactly these applications after compromising a tenant. Scoping limits the damage to the mailboxes the application really serves, and Exchange shows the scope in one place. Entra and Exchange grants add up, so the scope only works once the Entra grant is removed.

Impact

Each application must be reviewed with its owner to define the mailboxes it needs. Removing the Entra grant before the RBAC assignment is in place breaks the application; test with Test-ServicePrincipalAuthorization first.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader. Browse to Entra ID > Enterprise apps, and for each application open Security > Permissions > Admin consent: note the applications that hold application permissions on Microsoft Graph Mail.*, MailboxSettings.*, Calendars.*, Contacts.* or Office 365 Exchange Online full_access_as_app.
2. In Exchange Online PowerShell (read-only):

   Get-ServicePrincipal | Format-Table DisplayName, AppId, ObjectId
   Get-ManagementRoleAssignment -RoleAssigneeType ServicePrincipal |
     Format-Table RoleAssigneeName, Role, CustomResourceScope, RecipientWriteScope
   Get-ApplicationAccessPolicy | Format-Table AppId, AccessRight, ScopeName
   

3. Fail if an application holds a tenant-wide mailbox permission in Entra ID with no application access policy restricting it, or if an RBAC for Applications assignment has no scope.

Remediation

1. With each application owner, list the mailboxes it needs and put them in a management scope (for example a filter on a custom attribute) or an administrative unit.
2. In Exchange Online PowerShell (Exchange Administrator):

   New-ServicePrincipal -AppId <app id> -ObjectId <enterprise app object id> -DisplayName "<app>"
   New-ManagementScope -Name "<app> mailboxes" -RecipientRestrictionFilter "CustomAttribute10 -eq '<app>'"
   New-ManagementRoleAssignment -App <app id> -Role "Application Mail.Read" -CustomResourceScope "<app> mailboxes"
   Test-ServicePrincipalAuthorization -Identity <app id> -Resource <mailbox>
   

3. Once the test passes, remove the tenant-wide permission from the application in the Entra admin center (Enterprise apps > the app > Permissions > Revoke permission, Cloud Application Administrator or Privileged Role Administrator).

Rollback

Grant the Entra application permission again with admin consent while the scope is fixed.

References

• Role Based Access Control for Applications in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• New-ApplicationAccessPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Maester MT.1058 - Exchange application access policies must be configured Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-011 Disable Exchange Web Services, or restrict it to approved applications
• related CB-M365-APPS-011 Review high-risk API permissions granted to applications
• related CB-M365-APPS-002 Restrict user consent to applications

People and lifecycle