Forum Discussion

Tony Bulding's avatar
Tony Bulding
Copper Contributor
Oct 10, 2017

Azure Enterprise Application accessing a single mailbox

Hello,

 

I have a homegrown mail handler application that needs to access a shared mailbox in Exchange Online. I created an app registration for the mail handler, however, I cannot figure out how to grant the application permissions to manage the single shared mailbox. The only option is to grant access to ALL mailboxes and that is not acceptable.

 

Thanks

 

Tony

Access Management
Azure Active Directory (AAD)
Identity Management
microsoft 365

2 Replies

  • Josh Keefer's avatar
    Josh Keefer
    Copper Contributor
    Oct 10, 2017

    Hey Tony, 

    You may want to explore how Azure Administrative Units can help in this situation. 

    Using AU's you can delegate typically admin accounts to access 1 or many users/mailboxes. 

    However I am unsure if AU's can handle Shared Mailboxes since the usecase for AU's is to delegate admin access to scopes of users for administrative tasks. Furthermore you need delegate access to an application object rather than a privleged user object. So this is something you may want to explore. 

    Check out:

    http://www.deployazure.com/security/identity/azure-ad/azure-ad-administrative-units-in-exchange-online/

    and

    https://docs.microsoft.com/en-us/powershell/azure/active-directory/working-with-administrative-units?view=azureadps-2.0

     

    Hope this helps!

    • Tony Bulding's avatar
      Tony Bulding
      Copper Contributor
      Oct 11, 2017

      Josh,

       

      Thank you very much for the response. I can grant any account fullaccess to the mailbox in powershell (Add-MailboxPermission) . What I want to  avoid is having the Enterprise Application use credentials at all. Ideally, I want the application to interact with the KeyVault to get a URI to properly access the mailbox without ever having to see credentials.

       

      Thanks

       

      Tony

Resources