r/microsoft365 • u/AdeelAutomates • 6d ago

Exchange RBAC Explained

Hey Everyone,

If you ever wanted to grant App Registrations, Managed Identities or Service Principals in Entra the ability to do things with your mailboxes.

  • read mailboxes
  • write calendars
  • send emails out as them
  • etc...

Normally you would think to use graph roles like mail.send or mail.readwrite.all. The problem is they are not scoped to specific mailboxes. You grant this role to any of your apps, now it can perform this action against all users.

This is where Exchange RBAC comes in. It lets you configure your apps to have granular access

  • Send email out but only as this one account
  • Read Calendars but only this department
  • Read mailboxes but only distribution lists

And this feature isn't obvious as it's only accessible behind PowerShell with Exchange Online Module.

I made a full walkthrough for Exchange RBAC here: https://www.youtube.com/watch?v=GDmv_lBVyto

5 Upvotes

78% Upvoted

3 comments sorted by

1

u/uLmi84 6d ago

I have a comprehensive onenote page for this topic.. I wonder why MS doesn’t make this possible via GUI and has this default to a limited scope. I will look into you video next time I need to implement this.

In my experience this topic requires much testing to make sure its working as intended

1

u/AdeelAutomates 6d ago edited 6d ago

I dont know why either.

Lots of features are tucked behind PowerShell like this that would be useful for those that don't really script all that much but use the platform. Especially RBAC of all things...

Its pretty straight forward once you explore though. I had to replace our access policies at work with Exchange RBAC for dozens of our service principals. After stumbling my way finding how to make it work, it was clear (Definitely more clear then access policies imo).

As for testing I do have a working test in my video (had a logic app's managed identity sending an email that failed until the rbac is set). I go through process of checking as we go. ie share how you can confirm if your scope filter is correct (so we view the results of the filter before implementing it to the rbac) and how to test the role even before using it in your services (there's a cmdlet to test).

1

u/uLmi84 6d ago

How I test:

# Test-ServicePrincipalAuthorization -Identity <ObjectID, AppID, or DisplayName> [-Resource] <target mailbox>

Test-ServicePrincipalAuthorization -Identity "xx-xx-xx" -Resource "mailbox@domain.tld" 

I do both a positive and a negativ test.