Granting access to App for Exchange Mail Trace - Least restrictive

habeebbm · ‎Apr 12 2023

===================

We need to grant access via Oauth for an App to reach Email trace on Exchange Online

The management role for this is "message tracking" /Messagehygiene

The app doesn't have a service principal so we are not able to add it via Exchange Powershell New-ManagementRoleAssignment

Note - We do not want to grant Global reader access as this is a 3rd party managed App.

Any help is appreciated.

VasilMichev · ‎Apr 12 2023

There is no OAuth scope that grants access to this functionality, so you have to stick to the Exchange roles, or Azure AD role that maps to them.

Andres-Bohren · ‎Apr 12 2023

I've written a Blog Articles about something similar. I know - it's not quite the same but it should help you to get on track

Exchange Online custom RBAC Role with App Authentication (OAuth2)

Exchange RBAC Role for Set-Userphoto

Regards

Andres Bohren

Re: Granting access to App for Exchange Mail Trace - Least restrictive