Exchange application access policies must be configured

Contributed by Lukas Gosling with 3 co-contributorsAll contributors →

Part of Maester · Entra ID · App consent and permissions · All checks

Run this check

Invoke-Maester -TestId MT.1058

Overview

Application access policies in Exchange Online help you control which applications can access which mailboxes.

Without these policies, applications with Exchange permissions can access all mailboxes in your organization.

Microsoft Exchange related permissions that should be secured by application access policies include:

• Mail.Read
• Mail.ReadBasic
• Mail.ReadBasic.All
• Mail.ReadWrite
• Mail.Send
• MailboxSettings.Read
• MailboxSettings.ReadWrite
• Calendars.Read
• Calendars.ReadWrite
• Contacts.Read
• Contacts.ReadWrite

Exchange application access policies should be configured for all applications with Exchange permissions.

Remediation action

Follow the steps below to create an application access policy in Exchange Online that restricts the application’s access to mailboxes in a specific distribution group.

Connect to Exchange Online

Connect-ExchangeOnline

Define variables for your application

# Get these values from your Application Registration
$AppID = "<your-app-id>"  # e.g. "0a3ad682-b031-416d-86c2-bf263f8b46a3"
$GroupName = "AAP_$AppID"  # example naming convention for clarity
$Description = "Restrict this app to members of distribution group"

Create a mail-enabled security group for policy scope

# Create group and hide from address list
$DGroup = New-DistributionGroup -Name $GroupName -Type Security
Start-Sleep -Seconds 5  # Wait for group creation to propagate
Set-DistributionGroup -Identity $DGroup.WindowsEmailAddress -HiddenFromAddressListsEnabled $true

Create the application access policy

New-ApplicationAccessPolicy -AppId $AppID `
                          -PolicyScopeGroupId $DGroup.WindowsEmailAddress `
                          -AccessRight RestrictAccess `
                          -Description $Description

Add members to the security group

Add-DistributionGroupMember -Identity $GroupName -Member [email protected]

Verify the policy

# List all policies
Get-ApplicationAccessPolicy

# Test for specific user
Test-ApplicationAccessPolicy -Identity [email protected] -AppId $AppID

Details

Every attribute of this check

Field	Value
Test ID	MT.1058
Severity	Medium
Suite	Maester
Product	Entra ID
Related products	Exchange Online
Feature	App consent and permissions
Area	Applications and workload identities
Resource type	ServicePrincipal
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1114.002 Remote Email Collection
Supports controls	nist-800-53-r5:AC-6, nist-800-53-r5:AC-3
PowerShell test	Test-MtSpExchangeAppAccessPolicy
Services	Graph, ExchangeOnline
Long running	Yes

Source

• Test: tests/maester/entra/Test.MT.1058.ps1
• Documentation: tests/maester/entra/Test.MT.1058.md