# Exchange application access policies must be configured Application access policies in Exchange Online help you control which applications can access which mailboxes. Source: https://maester.dev/docs/tests/MT.1058

Contributed by Lukas Gosling with 3 co-contributorsAll contributors →

Part of Maester · Entra ID · App consent and permissions · All checks

```powershell title="Run this check" Invoke-Maester -TestId MT.1058 ``` ## Overview Application access policies in Exchange Online help you control which applications can access which mailboxes. Without these policies, applications with Exchange permissions can access all mailboxes in your organization. Microsoft Exchange related permissions that should be secured by application access policies include: - Mail.Read - Mail.ReadBasic - Mail.ReadBasic.All - Mail.ReadWrite - Mail.Send - MailboxSettings.Read - MailboxSettings.ReadWrite - Calendars.Read - Calendars.ReadWrite - Contacts.Read - Contacts.ReadWrite Exchange application access policies should be configured for all applications with Exchange permissions. ### Remediation action Follow the steps below to create an application access policy in Exchange Online that restricts the application's access to mailboxes in a specific distribution group. #### Connect to Exchange Online ```powershell Connect-ExchangeOnline ``` #### Define variables for your application ```powershell # Get these values from your Application Registration $AppID = "" # e.g. "0a3ad682-b031-416d-86c2-bf263f8b46a3" $GroupName = "AAP_$AppID" # example naming convention for clarity $Description = "Restrict this app to members of distribution group" ``` #### Create a mail-enabled security group for policy scope ```powershell # Create group and hide from address list $DGroup = New-DistributionGroup -Name $GroupName -Type Security Start-Sleep -Seconds 5 # Wait for group creation to propagate Set-DistributionGroup -Identity $DGroup.WindowsEmailAddress -HiddenFromAddressListsEnabled $true ``` #### Create the application access policy ```powershell New-ApplicationAccessPolicy -AppId $AppID ` -PolicyScopeGroupId $DGroup.WindowsEmailAddress ` -AccessRight RestrictAccess ` -Description $Description ``` #### Add members to the security group ```powershell Add-DistributionGroupMember -Identity $GroupName -Member user@contoso.com ``` #### Verify the policy ```powershell # List all policies Get-ApplicationAccessPolicy # Test for specific user Test-ApplicationAccessPolicy -Identity user@contoso.com -AppId $AppID ``` ## Details

Every attribute of this check

| Field | Value | | --- | --- | | Test ID | MT.1058 | | Severity | Medium | | Suite | Maester | | Product | Entra ID | | Related products | Exchange Online | | Feature | App consent and permissions | | Area | Applications and workload identities | | Resource type | ServicePrincipal | | User impact | Low | | Implementation cost | Medium | | MITRE ATT&CK | T1114.002 Remote Email Collection | | Supports controls | nist-800-53-r5:AC-6, nist-800-53-r5:AC-3 | | PowerShell test | [Test-MtSpExchangeAppAccessPolicy](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1058.ps1) | | Services | Graph, ExchangeOnline | | Long running | Yes |

## Source - Test: [`tests/maester/entra/Test.MT.1058.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1058.ps1) - Documentation: [`tests/maester/entra/Test.MT.1058.md`](https://github.com/maester365/maester/blob/main/tests/maester/entra/Test.MT.1058.md)