MT.1252 - Apps scoped with Exchange RBAC for Applications should not hold the same or a broader permission tenant-wide in Microsoft Entra ID.
Overview
RBAC for Applications in Exchange Online lets you grant an app a permission, such as Mail.Read, for a limited set of mailboxes.
Permissions granted in Exchange Online and in Microsoft Entra ID add together. If the app also holds the same Microsoft Graph application permission in Microsoft Entra ID, or a broader one that includes it (for example Mail.ReadWrite covers Mail.Read), that grant covers every mailbox in the organization, so the Exchange scope has no effect. The app can read or change mail far beyond what the Exchange assignment suggests.
This test fails when an app holds a permission through a scoped Exchange RBAC for Applications assignment and the same or a broader permission through a tenant-wide Microsoft Graph grant.
If an Application Access Policy with RestrictAccess limits the app's Entra grant, and the policy supports that permission, the Entra grant no longer covers every mailbox. Those apps are listed for review instead of failed. The remediation below applies to failed apps.
Remediation action
For each app listed below, keep the scoped Exchange assignment and remove the tenant-wide grant in Microsoft Entra ID.
- In the Microsoft Entra admin center, open Enterprise applications and select the app.
- Open Security > Permissions.
- Under Admin consent, find the Microsoft Graph permission shown in the Entra grant column of the result and select Revoke permission.
- Confirm the app still works for the mailboxes in its Exchange scope. You can check the effective Exchange permissions with
Test-ServicePrincipalAuthorization -Identity <AppId>.
Related links
- Role Based Access Control for Applications in Exchange Online - Microsoft Learn
- Review permissions granted to enterprise applications - Microsoft Learn
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1252 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Related products | Exchange Online |
| Feature | App consent and permissions |
| Area | Applications and workload identities |
| Resource type | ServicePrincipal |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1114.002 Remote Email Collection |
| Supports controls | nist-800-53-r5:AC-6, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCheckMT1252 |
| Services | Graph, ExchangeOnline |
Source
- Test:
tests/maester/entra/Test.MT.1252.ps1 - Documentation:
tests/maester/entra/Test.MT.1252.md