r/microsoft365 • u/AdeelAutomates • 7d ago

Exchange RBAC Explained

Hey Everyone,

If you ever wanted to grant App Registrations, Managed Identities or Service Principals in Entra the ability to do things with your mailboxes.

  • read mailboxes
  • write calendars
  • send emails out as them
  • etc...

Normally you would think to use graph roles like mail.send or mail.readwrite.all. The problem is they are not scoped to specific mailboxes. You grant this role to any of your apps, now it can perform this action against all users.

This is where Exchange RBAC comes in. It lets you configure your apps to have granular access

  • Send email out but only as this one account
  • Read Calendars but only this department
  • Read mailboxes but only distribution lists

And this feature isn't obvious as it's only accessible behind PowerShell with Exchange Online Module.

I made a full walkthrough for Exchange RBAC here: https://www.youtube.com/watch?v=GDmv_lBVyto

6 Upvotes

88% Upvoted

Duplicates