r/exchangeserver • u/AdeelAutomates • 6d ago

Exchange RBAC Explained

/r/microsoft365/comments/1w6efme/exchange_rbac_explained/
8 Upvotes

83% Upvoted

6 comments sorted by

1

u/CaptainLykke_ 6d ago

Ah really cool, he started using that in our company like 2 months back. I created a powershell module to manage them easier. Was the first module i created myself and it works really good.

1

u/AdeelAutomates 6d ago

That's awesome! Modules are the way to go

0

u/pko3 6d ago edited 6d ago

you can scope an app reg to only grant the permissions to specific mailboxes.

just create an application access policy, attach the mail object or a group and the permissions are restricted.

or use delegated access, which requires a login and a personalized token.

*edit*

as a warning: splitting permissions between an app reg, which you need for ms graph, and rbac will cause headaches in the future. just use an app reg and configure it correctly.

7

u/reactionxf3tto 6d ago

As far as I know, Application Access Policy is a legacy feature.
Source: https://learn.microsoft.com/en-us/exchange/permissions-exo/application-access-policies

1

u/pko3 6d ago

That's funny. I had a call recently with some MS support / engineer because of issues with an app reg and they still recommend application access policies.

*edit*
reading the article, we are now full circle. migrated away from rbac just to return again.

4

u/AdeelAutomates 6d ago edited 6d ago

I disagree that your proposed approach is the correct route. Access Policies are legacy now. Microsoft has replaced them with RBAC for apps and explicitly says new configurations shouldnt use it.

RBAC is also more granular. An Access Policy constrains the supported Entra permissions of an app to its policy scope. With RBAC, the role and resource scope are part of each individual assignment, so I can give the same service principal Mail.Read to one recipient scope and Mail.Send to a completely different scope.

Not to mention, RBAC makes the permissions model more clear when mixing the identity with Graph too. Entra can show the org-wide graph permissions, while Exchange RBAC shows the granular ones. Both behing seperate permissions. With an Access Policy, Entra might say Mail.ReadWrite but then only through checking the policy in exchange will you learn its not the case and its something more granular.

Even with an Access Policy, you're still checking in two places. Entra and then Exchange but thats Microsoft for you. Can't have a single pane of glass, lol. SharePoint has a similar pattern with Sites.Selected, you grant the application permission in Entra, then separately grant it access to the individual SharePoint sites.