The default that should frighten you
A Graph app granted APPLICATION-scoped Mail.Read / Mail.Send / Mail.ReadWrite (admin-consented, no user context) can access ALL mailboxes in the tenant — the whole point of application scope, and a catastrophe waiting if the app (or its secret) is compromised. The number of tenants running a decade-old 'reporting' app with tenant-wide Mail.Read and a never-rotated secret is not small.
The leash: ApplicationAccessPolicy
Get/New-ApplicationAccessPolicy scopes an app's mailbox access to a MAIL-ENABLED SECURITY GROUP — 'this app may only touch the mailboxes in this group'. The pattern:
- App needs to read the shared support mailbox → create a group holding just that mailbox → RestrictAccess policy binding the app to the group. Now the app's tenant-wide grant is operationally narrow.
- Test it: Test-ApplicationAccessPolicy proves in-scope allowed / out-of-scope denied — the leak test for robots (the Copilot agent-egress discipline, mail edition).
The gap to know: ApplicationAccessPolicy governs EXO mailbox APIs; it does not scope every Graph resource — pair with proper least-privilege GRANTS (don't consent Mail.ReadWrite when Mail.Send suffices) and the RBAC-for-Applications model where it applies. The layered answer: minimal permission + access policy scope + secret/cert hygiene.
Secret & consent hygiene (the compromise surface)
Certificates over secrets (rotatable, less leakable — serv365's own model); expiry monitored (the credential-expiry alerting the Pulse concept holds); consent reviewed (which apps hold Mail.* at all — the standing inventory); and offboarding for APPS (the decade-old reporting app whose owner left — the flow-orphan lesson, mail-app edition).
What to watch (proofs)
- The Mail.* app inventory: enterprise apps with application-scoped Mail permissions — the list that should be short and entirely explained; every entry gets an owner + an access policy + a credential-expiry watch.
- Scope proofs: Test-ApplicationAccessPolicy per scoped app — in/out-of-scope demonstrated, screenshotted into the app's record.
- Credential runway: app secret/cert expiries (the scanned app-credential pattern) — the silent-outage AND the never-rotated-risk, one report.
- Anomalous app mail activity: an app reading/sending outside its expected mailboxes/volume (audit + the access policy denials) — a compromised app looks like BEC without the human.