Skip to main content
The organization-wide Microsoft 365 integration collects consent once for your tenant. In Entra ID that consent therefore applies to the whole organization at first. You then limit the actual access to calendars and mailbox settings in Exchange Online. This article is for Exchange admins who want anny to use only selected Outlook room and resource mailboxes. Other Microsoft permissions, for example for the directory or Teams, use other mechanisms. The steps here do not restrict them.
You set this up in Entra ID and Exchange Online, not in anny. In anny you then couple individual calendars as usual under Account → Apps & Integrations → Microsoft 365.

​
How access is limited

There is not a single switch. Consent in Entra ID stays tenant-wide. For Calendars.ReadWrite and MailboxSettings.ReadWrite you create a resource scope in Exchange Online: a mail-enabled group plus RBAC for Applications. The app then gets calendar access only to mailboxes that are direct members of that group. Grants in Exchange are additive to Entra ID. While the tenant-wide Graph permissions remain in Entra ID, the scope has no effect.

​
Requirements

  • Exchange Administrator role, or membership in Organization Management
  • Exchange Online (cloud). The integration does not support on-premises mailboxes.
  • A mail-enabled security group, Microsoft 365 group, or distribution list. Only direct members count, nested groups do not.
  • The room and resource mailboxes that anny should sync are direct members of this group.
  • The Application ID and Object ID of the enterprise application. Take the values from Enterprise applications, not from App registrations.

​
Limit access to specific mailboxes

1

Create the group

Create a mail-enabled group, for example anny-scope. Add the room and resource mailboxes whose calendars anny may use.
2

Connect to Exchange Online

Open PowerShell and connect to Exchange Online.
3

Create the service principal

Create the pointer to the enterprise application. The IDs come from Enterprise applications, not from App registrations.
4

Define the scope

Limit access to the members of the group. The filter needs the distinguished name.
5

Assign roles with the scope

Assign calendar and mailbox settings only for this scope.
6

Verify

Test whether a specific mailbox is in scope. The test bypasses the permission cache and only considers Exchange RBAC, not the grants in Entra ID.
7

Remove tenant-wide Entra grants

In Entra ID under Enterprise applications → your anny app → Permissions, remove the organization-wide application permissions Calendars.ReadWrite and MailboxSettings.ReadWrite. Without this step access stays tenant-wide, because Entra ID and Exchange add the rights together.
Once the scope is active and the tenant-wide Entra grants are removed, anny can only use the mailboxes in the group as calendars. Microsoft documents RBAC for Applications on Microsoft Learn.
Changes to app permissions can take 30 minutes to two hours. The test with Test-ServicePrincipalAuthorization bypasses this cache. A successful test therefore does not mean Graph already enforces the scope, and it does not check whether tenant-wide grants still exist in Entra ID.

​
Limitations

  • You only limit calendar access and mailbox settings. The account list in Microsoft calendar can still show more addresses, because it comes from the directory.
  • Nested group members are out of scope.
  • The personal Outlook integration is a different connection type. This procedure applies only to the organization-wide Microsoft 365 integration.

​
FAQ

The Microsoft calendar picker lists accounts from the directory. The Exchange scope limits calendar access, not this list. You can only sync a mailbox that is a direct group member. Other mailboxes fail.
The tenant-wide Graph permissions in Entra ID are then still active. Exchange RBAC adds to them and does not constrain access while Entra ID still grants the same access organization-wide. Remove Calendars.ReadWrite and MailboxSettings.ReadWrite on the enterprise application.
Yes. Every room or resource mailbox that anny should sync must be a direct member of the mail-enabled group.

​
Troubleshooting

The mailbox is often not a direct member of the group, or the permission cache is still active. Check membership and wait up to two hours, or test with Test-ServicePrincipalAuthorization.
Test-ServicePrincipalAuthorization ignores Entra grants. Remove the tenant-wide application permissions in Entra ID and wait for the cache to expire.