Created by Claude - please verify

OWA policies - security-relevant settings per policy with the number of mailboxes assigned.

Required Microsoft Graph permissions

Exchange.ManageAsApp (+ View-Only Organization Management) — application permission, granted to the app registration with admin consent.

Licence: None; 'app enforced restrictions' needs Entra ID P1 for the Conditional Access side.

Endpoints: Get-OwaMailboxPolicy · Get-CASMailbox (OwaMailboxPolicy)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Outlook on the Web Mailbox Policies

Outlook on the web works from any browser. Unless the OWA policy limits it - and a Conditional Access policy with 'Use app enforced restrictions' enforces it - attachments can be downloaded on any unmanaged or public computer, saved to third-party storage, or cached for offline use.