Limit Exchange application permissions to the mailboxes an app actually needs.
In Entra ID, if we grant the Mail.Read application permission to an application, it can read ALL email in the organization by default.
The most common misconfigured apps I see are helpdesk, SIEM, and awareness training.
If someone gains access to the secrets for the helpdesk app or a vendor is compromised, all that email can be accessed. With Mail.ReadWrite, it can also be modified or deleted.
Limit the app to the mailboxes it actually needs.
My original post used an Application Access Policy: create a mail-enabled security group, add the mailboxes, and scope the app to that group. That’s now the legacy approach; Microsoft says not to use it for new configurations.
As I’ve covered in later posts, RBAC for Applications is the correct way to handle limiting what apps have access to in Exchange. Give the application the required Exchange role with a recipient scope.
One important gotcha: permissions are additive. A scoped RBAC assignment doesn’t restrict a matching organization-wide grant in Entra. As part of a planned migration, remove the corresponding unscoped Entra permission and verify the intended mailbox access. Otherwise, the app can still have access to everything.
Exchange RBAC for Applications and migration guidance
Original posts: 14 September 2023 and why scope matters. Related updates: old versus new approach and RBAC guidance. Documentation checked 14 October 2026.