Is it Possible to Use RBAC to Restrict the Scope of Outlook Mailboxes an External Application Can Access?

Question

Is it Possible to Use RBAC to Restrict the Scope of Outlook Mailboxes an External Application Can Access?

zhang xiao 20

I am currently developing a feature to sync calendars from an external application into employees' mailboxes within the company.

For security reasons, the company needs to prevent the external application from being able to modify the calendars of any user's mailbox in the company domain via the API. Therefore, it is required that only a limited subset of mailboxes be accessible for modification.

The company suggests using RBAC to restrict Calendars.ReadWrite so that it can only access certain mailboxes. Are there any issues with this approach?

0 个注释

问题作者接受的答案

0 个其他答案

你的答案

Answer 1

Please note that this is the zh-cn forum. We kindly recommend posting your question in Chinese (Simplified) so that more community members can assist you. Alternatively, you may consider posting in the English forum if you prefer to use your native language. We sincerely appreciate your understanding.

Hi @zhang xiao

Yes, using Exchange Online RBAC for Applications is actually the recommended approach for this scenario.

The Calendars.ReadWrite application permission by itself grants access to all mailboxes in the tenant. However, Exchange Online now supports RBAC for Applications, which allows you to assign the permission together with a resource scope (for example, a Management Scope or Administrative Unit) so that the application can only access a defined subset of mailboxes. This capability was introduced as the successor to Exchange Online Application Access Policies.

As a result, your external application can be granted Calendars.ReadWrite, while still being restricted to only the mailboxes included in the configured scope. Mailboxes outside that scope will not be accessible through the app's application permissions.

A few considerations:

RBAC for Applications only governs Exchange Online resources and supported application roles.
The Microsoft Entra ID application permission (Calendars.ReadWrite) still needs to be granted, and the Exchange RBAC assignment then further limits which mailboxes can actually be accessed.
If you're starting a new implementation, Microsoft recommends RBAC for Applications rather than the older Application Access Policies model.

Ref: Role Based Access Control for Applications in Exchange Online

Therefore, there is no inherent issue with this approach.