Limit access to groups or individual mailboxes using a service application in Azure Ad

Question

I have an Azure integrated service application (daemon app) with permissions to the Microsoft graph api, I can now read all the mailboxes for the entire company, which is aw

Answer 1

The daemon app which use the client credential to acquire the access token.

The client credential flow is used to as an authorization grant typically when the client is acting on its own behalf. And it is not able to specify mailboxes that the app can have access.

You can achieve this by implement the business logic in the daemon app.

Answer 2

This Microsoft doc appears to give the answer Scoping application permissions to specific Exchange Online mailboxes https://docs.microsoft.com/en-us/graph/auth-limit-mailbox-access

Administrators who want to limit the app access to a specific set of mailboxes can use the New-ApplicationAccessPolicy PowerShell cmdlet to configure access control. This article covers the basic steps to configure an application access policy.