Thanks Greg Taylor - EXCHANGE .
I've seen that but that grants access to all mailboxes and I can't find a method to restrict to a single mailbox. The use case is we have multiple app teams that have integrations with mailboxes and they currently user EWS with Basic Auth. I've read that the EXO Access Restrictions do not apply to EWS, only the Graph API.
I guess we will be encouraging our developers to migrate to Graph vs. continuing to use EWS.
One other gap we still see is around EXO PowerShell. We have batch scripts that are using basic auth to connect. I know that EXO PowerShell supports MFA via the OAuth2.0 Authorization Code grant type, but that sub-optimal for batch jobs. Will there be support for using a Service Principal and OAuth2.0 client credential grant type to connect to EXO PowerShell?