Background:
We are trying to replace the basic authentication with Oauth2.0, and created a "workable" solution with below steps [1]:
1.register application (TestApp for example) in Azure AD with some application permissions: Mail.read (Microsoft Graph) and full_access_as_app (Office 365 Exchange Online)
2.Grant admin consent for AD
3.Add code to get authentication token by using client credential provider
4.Add token to EWS request
The issue we found is every user under this Azure AD can fetch email from mailboxes with requested token by using TestAPP's data: client_id, client_secret, tenant_id.
Is there any way to restrict the set of users in this Azure AD to request the authentication token?
The "Enable User assignment required" method[2] didn't solve the issue as all users under Azure AD can fetch the emails with auth token acquired by using TestAPP's data.
Please let me know if anyone has any advices for this issue, thanks in advance!
Reference:
[1] https://docs.microsoft.com/en-us/exchange/client-developer/exchange-web-services/how-to-authenticate...
[2] https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-restrict-your-app-to-a-set-of-...
