Azure Enterprise Application accessing a single mailbox

[Tony Bulding]

Hello,

I have a homegrown mail handler application that needs to access a shared mailbox in Exchange Online. I created an app registration for the mail handler, however, I cannot figure out how to grant the application permissions to manage the single shared mailbox. The only option is to grant access to ALL mailboxes and that is not acceptable.

Thanks

Tony

[#2]

Hey Tony, 

You may want to explore how Azure Administrative Units can help in this situation. 

Using AU's you can delegate typically admin accounts to access 1 or many users/mailboxes. 

However I am unsure if AU's can handle Shared Mailboxes since the usecase for AU's is to delegate admin access to scopes of users for administrative tasks. Furthermore you need delegate access to an application object rather than a privleged user object. So this is something you may want to explore. 

Check out:

http://www.deployazure.com/security/identity/azure-ad/azure-ad-administrative-units-in-exchange-onli...

and

https://docs.microsoft.com/en-us/powershell/azure/active-directory/working-with-administrative-units...

Hope this helps!

[#3]

Josh,

Thank you very much for the response. I can grant any account fullaccess to the mailbox in powershell (Add-MailboxPermission) . What I want to  avoid is having the Enterprise Application use credentials at all. Ideally, I want the application to interact with the KeyVault to get a URI to properly access the mailbox without ever having to see credentials.

Thanks

Tony