Is it possible to restrict the Application API permissions of an Azure AD web application to one account?
I'm developing an AWS Lambda function which will need to access an Outlook 365 inbox at a regular interval. I'm using Graph API for accessing the inbox.
I created a new Azure AD web application registration using the Azure Active Directory admin center.(https://aad.portal.azure.com/) When assigning API Permissions to my app, I have an option to choose between Delegated permissions and Application permissions. I can't use delegated permissions since my code will run without any user interaction.
When choosing application permissions, I can't find a way to restrict the permission to one user account. For example, if I try to give the app Mail.Read application permission, it'll get access to all mailboxes in the enterprise. Or maybe I'm interpreting the permission description incorrectly.
How do I give my app API permissions to one user's mailbox?
This issue was solved by Shiva's comment, add it as the answer to close the question:
Some apps call Microsoft Graph using their own identity and not on behalf of a user. For example, the Mail.Read application permission allows apps to read mail in all mailboxes without a signed-in user.
Configuring ApplicationAccessPolicy is used to limit the app access to a specific set of mailboxes.
1.Connect to Exchange Online PowerShell
Connect-ExchangeOnline -UserPrincipalName <UPN> [-ExchangeEnvironmentName <Value>] [-DelegatedOrganization <String>] [-PSSessionOption $ProxyOptions]
2.Identify the app’s client ID and a mail-enabled security group to restrict the app’s access to.
3.Create an application access policy.
New-ApplicationAccessPolicy -AppId e7e4dbfc-046f-4074-9b3b-2ae8f144f59b -PolicyScopeGroupId EvenUsers@contoso.com -AccessRight RestrictAccess -Description "Restrict this app to members of distribution group EvenUsers."
For more details about New-ApplicationAccessPolicy, see here.
- How to resolve paging when retrieving data from REST API in R
- SearchService deployment fails if the resource exists
- Azure Bicep - Referencing a variable that cannot be calculated at the start
- Local development with Azure SignalR Service and Azure Functions
- Azure Functions & Application Insights requests "Operation Link" empty
- Disabling allow public blob access using terraform
- how to retrieve all resources under given subnet using Azure Resource Graph Explorer query
- I'm using SSIS in ADF to move .csv from a blob container to another and then ingest into a Azure SQL database. I get an assembly error
- How to build expression in ADF from json using parameterized variable?
- Reference a variable azure pipeline not working
- Graph Powershell adding a user to PIM for a privileged security group
- Indexing static HTML blob storage content with Azure Cognitive Search is not working as expected
- Azure python webapp deploy shows as running even though it is successful
- Azure pipeline get Pull request source and target branch name
- Error while copying Azure Storage table from one Storage to another storage table using Powershell script
- Azure Function App Fails to Delete Blob Image After Deployment
- Use Azure AD authentication but manage roles in database in .NET 6
- Microsoft Azure VMs IaaS or PaaS?
- Can an application property be updated/deleted from a ServiceBusReceivedMessage?
- Why is my Blazor Web App throwing a SocketException when authenticating with OpenIddict when deployed to Azure App Service?
- RPC failed: curl 56 failure when receiving data from the peer
- Read 'Attribute & Claims' from SAML Entra application configuration using PowerShell
- Reading Excel file returns 'Invalid Request' error
- Is it possible to clone an Azure Container App?
- Unable to Enable Encryption at host for Azure VM
- Application Insights does not capture information level logging
- How to look up logical partition count and size in Cosmos DB
- AzureRmWebAppDeployment@4 tries to deploy to a wrong URL to Linux app plan
- Azure B2C client credentials flow throws invalid_grant AADB2C90085
- Why I can't create azurerm_app_service connection?