Created by Claude - please verify

Mailbox app scoping - joins Entra application permissions with Exchange Application Access Policies and RBAC for Applications.

Required Microsoft Graph permissions

Application.Read.All Exchange.ManageAsApp (+ View-Only Organization Management) — application permissions, granted to the app registration with admin consent.

Licence: None.

Endpoints: GET /v1.0/servicePrincipals/{Graph, Exchange Online}/appRoleAssignedTo · Get-ApplicationAccessPolicy · Get-ManagementRoleAssignment -RoleAssigneeType ServicePrincipal · Get-ServicePrincipal (Exchange)

An Entra application permission such as Mail.Read is tenant-wide. RBAC for Applications only helps once the Entra grant is removed; an Application Access Policy narrows the Entra grant but is being replaced by RBAC for Applications.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Mailbox-reading Apps Not Scoped to Specific Mailboxes

Any app holding a Mail, Calendars, Contacts or MailboxSettings application permission - or Exchange's full_access_as_app - can read every mailbox, including the CEO's and HR's, unless Exchange limits it. This report shows each such app and whether anything does.