How to Restrict Microsoft Graph Mail.Send for a Daemon Application
Question details
The user needs to restrict the Microsoft Graph Mail.Send application permission for a daemon application so it can only send emails from specific authorized mailboxes, rather than the entire tenant.
- Product
- Microsoft Graph API
- Device & OS
- not provided
- Scenario
- Configuring enterprise application permissions in Microsoft 365 to prevent a daemon app from sending mail on behalf of arbitrary users without a signed-in user.
- Observed behavior
- The daemon application has tenant-wide Mail.Send permissions, and simply assigning specific users to the enterprise application in Azure does not successfully limit its mailbox access scope.
Ensure you have global administrator or Exchange administrator privileges in your Microsoft 365 tenant and can connect to Exchange Online PowerShell.
Configure Application Access Policies in Exchange Online
Use Exchange Online Application Access Policies to restrict the daemon application's Mail.Send permissions to a specific mail-enabled security group.
By default, Application permissions in Microsoft Graph apply to the entire tenant. To limit which mailboxes a daemon app can send mail from, you must create a boundary using Application Access Policies via Exchange Online PowerShell.
Open an elevated PowerShell window and connect to Exchange Online using the Connect-ExchangeOnline cmdlet with your admin credentials.
Create a new mail-enabled security group in the Microsoft 365 admin center and add the mailboxes that the daemon application is allowed to access.
Run the New-ApplicationAccessPolicy cmdlet, providing the AppId of your daemon application and the PolicyScopeGroupId of the newly created security group.
Ensure the AccessRight parameter is set to RestrictAccess to enforce the boundary for the specified application.
Use the Test-ApplicationAccessPolicy cmdlet with a target mailbox identity to verify that access is correctly granted or denied based on your policy.
Implement Exchange Online RBAC for Applications
Use the newer Exchange Online Role-Based Access Control (RBAC) to define precise mailbox access scopes for service principals.
Experience a Lightweight Office Suite with WPS Office
While configuring complex Microsoft Graph API permissions requires tenant admin controls in Azure, handling your daily documents doesn't have to be complicated. WPS Office provides a free, lightweight, and user-friendly alternative to Microsoft Office for creating, editing, and managing your files seamlessly.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install WPS Office: Run the downloaded setup file and follow the quick installation prompts to set up the software.
- 3. Open Your Documents: Launch WPS Office and directly open your existing Microsoft Office files. Your formatting, formulas, and layouts will remain perfectly intact.
Frequently Asked Questions
Why doesn't assigning users to my enterprise application limit its permissions?
Assigning users to an enterprise application only restricts which users can actively sign into the app. Because daemon applications use 'Application Permissions' (like Mail.Send) that operate without a signed-in user, these permissions inherently apply tenant-wide unless bounded by Exchange Online Application Access Policies.
Can I restrict Microsoft Graph Mail.Send permissions directly from the Azure Portal?
While you grant the base Mail.Send application permission in the Azure Portal (Microsoft Entra ID), you cannot restrict its mailbox scope there. Scoping must be configured using Exchange Online Application Access Policies or RBAC controls via PowerShell.
How do I verify if my application access policy is actually working?
You can use the Test-ApplicationAccessPolicy cmdlet in Exchange Online PowerShell. By providing the AppId of your daemon application and the email address of a target mailbox, the cmdlet will return whether access is granted or denied.
