Commands › Exchange Online

New-ApplicationAccessPolicy

Exchange Online ExchangeOnlineManagement New-*

> [!IMPORTANT] > App Access Policies are replaced by Role Based Access Control for Applications. To learn more, see Role Based Access Control for Exchange Applications. Don't create new App Access Policies as these policies will eventually require migration to Role Based Access Control for Applications. Use the New-ApplicationAccessPolicy cmdlet to restrict or deny access to a specific set of mailboxes by an application that uses APIs (Outlook REST, Microsoft Graph, or Exchange Web Services (EWS)). These policies are complementary to the permission scopes that are declared by the application.

Quick start script

# New-ApplicationAccessPolicy — quick start (serv365.ai)
# 1. Connect (app-only shown; interactive: omit the certificate parameters)
Connect-ExchangeOnline -CertificateThumbprint $thumb -AppId $appId -Organization $org

# 2. Capture the current state first — you cannot roll back what you never recorded
$before = Get-ApplicationAccessPolicy
$before | Format-List

# 3. Make the change (dry run first)
New-ApplicationAccessPolicy -AccessRight <ApplicationAccessPolicyIdParameter> -AppId <String[]> -PolicyScopeGroupID <RecipientIdParameter> -WhatIf
New-ApplicationAccessPolicy -AccessRight <ApplicationAccessPolicyIdParameter> -AppId <String[]> -PolicyScopeGroupID <RecipientIdParameter>

# 4. Verify and diff
$after = Get-ApplicationAccessPolicy
Compare-Object ($before | Out-String) ($after | Out-String)

Syntax

New-ApplicationAccessPolicy -AccessRight <ApplicationAccessPolicyRight> -AppId <String[]> -PolicyScopeGroupId <RecipientIdParameter>
 [-Confirm]
 [-Description <String>]
 [-WhatIf]
 [<CommonParameters>]

Parameters (6)

Parameter	Type	Required	What it controls
-AccessRight	ApplicationAccessPolicyIdParameter	yes	The AccessRight parameter specifies the restriction type that you want to assign in the application access policy. Valid values are:
-AppId	String[]	yes	The Identity parameter specifies the GUID of the apps to include in the policy. To find the GUID value of an app, run the command Get-App \| Format-Table -Auto DisplayName,AppId.
-PolicyScopeGroupID	RecipientIdParameter	yes	The PolicyScopeGroupID parameter specifies the recipient to define in the policy. Valid recipient types are security principals in Exchange Online (users or groups, including nested groups, that can have permissions...
-Confirm	SwitchParameter		The Confirm switch specifies whether to show or hide the confirmation prompt. How this switch affects the cmdlet depends on whether the cmdlet requires confirmation before proceeding.
-Description	String		The Description parameter specifies a description for the policy. If the value contains spaces, enclose the value in quotation marks (").
-WhatIf	SwitchParameter		The WhatIf switch shows what the command does without making any changes. You don't need to specify a value with this switch.

Reference facts derived from Microsoft documentation, © Microsoft, licensed CC BY 4.0; restructured with original guidance by serv365.ai.