HVE OAuth documentation: Does Mail.Send application permission still grant tenant-wide send access?

Hello,

I would like clarification regarding the OAuth configuration documented for High Volume Email in Microsoft 365.

The documentation instructs administrators to add the Office 365 Exchange Online Mail.Send application permission to an Entra ID application and grant tenant-wide admin consent.

The same section states:

The Mail.Send application permission does not grant the ability to send email from all Exchange mail users. Following the described configuration, only HVE Account type mail users will be able to send email, unless the application is explicitly authorized for other mail users through Exchange application access controls.

It then refers to Application Access Policies or Role Based Access Control for Applications in Exchange Online.

I do not understand how the documented configuration enforces this restriction.

According to the Exchange Online RBAC for Applications documentation:

• An unscoped application permission granted in Microsoft Entra ID is independent of Exchange Online RBAC assignments.
• Entra ID permissions and Exchange Online RBAC permissions are additive.
• A scoped RBAC assignment does not restrict an existing unscoped permission granted through Microsoft Entra ID.
• The unscoped Entra ID permission must be removed if Exchange Online RBAC is intended to provide the effective resource scope.

This appears to conflict with the HVE instructions because they explicitly require the unscoped Mail.Send application permission and tenant-wide admin consent.

The documented Add-HVEAppAccess configuration also appears to control which Entra applications can use a specific HVE account. It does not appear to restrict what other Exchange mail users the application can access through other supported Exchange endpoints.

Could Microsoft please clarify the following points?

Does the Mail.Send application permission used in the HVE guide have a special HVE-only authorization behavior?

1. If yes, where is this HVE-specific restriction technically enforced? I cannot see the restriction using EXO PS.

Does the restriction apply only when the token is used against smtp.hve.mx.microsoft, or does it also prevent the same application and token from sending through other Exchange Online endpoints?

Can the same service principal use the granted Mail.Send application permission to send as a regular Exchange Online mailbox through Microsoft Graph, standard SMTP OAuth, or another Exchange protocol?

1. Is an Application Access Policy created automatically when an application follows the HVE configuration or is an Exchange Online RBAC role assignment created automatically?

If neither control is created automatically, how can the tenant-wide Mail.Send application permission be considered restricted to HVE mail users?

Should the guide instead use an HVE-specific application permission or an Exchange RBAC role such as Application SMTP.SendAsApp, without granting an unscoped Mail.Send permission in Entra ID?

My current interpretation is:

• The HVE endpoint might only accept HVE account identities.
• Add-HVEAppAccess restricts which applications can authenticate as a specific HVE account.
• However, neither behavior necessarily restricts the tenant-wide authorization granted to the service principal by the Entra ID Mail.Send application permission.
• Therefore, following the guide may give the application broader permission than the note suggests.

Please confirm whether this interpretation is correct. If it is not correct, please document the exact authorization layer that prevents access to regular Exchange mailboxes.

Relevant documentation:

• OAuth authentication for High Volume Email
• RBAC for Applications in Exchange Online
• Add-HVEAppAccess documentation