> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Limit Microsoft 365 calendar access to specific mailboxes

> Restrict the Microsoft 365 integration so it can only sync selected Outlook resource calendars.

The organization-wide [Microsoft 365 integration](https://docs.anny.co/en/m365-workspace.md) collects consent once for your tenant. In Entra ID that consent therefore applies to the whole organization at first. You then limit the actual access to calendars and mailbox settings in Exchange Online.

This article is for Exchange admins who want anny to use only selected Outlook room and resource mailboxes. Other Microsoft permissions, for example for the directory or Teams, use other mechanisms. The steps here do not restrict them.

> [!TIP]
>
> You set this up in Entra ID and Exchange Online, not in anny. In anny you then couple individual calendars as usual under **Account** → **Apps & Integrations** → **Microsoft 365**.

## How access is limited

There is not a single switch. Consent in Entra ID stays tenant-wide. For `Calendars.ReadWrite` and `MailboxSettings.ReadWrite` you create a resource scope in Exchange Online: a mail-enabled group plus RBAC for Applications.

The app then gets calendar access only to mailboxes that are direct members of that group. Grants in Exchange are additive to Entra ID. While the tenant-wide Graph permissions remain in Entra ID, the scope has no effect.

## Requirements

* Exchange Administrator role, or membership in **Organization Management**
* Exchange Online (cloud). The integration does not support on-premises mailboxes.
* A mail-enabled security group, Microsoft 365 group, or distribution list. Only direct members count, nested groups do not.
* The room and resource mailboxes that anny should sync are direct members of this group.
* The **Application ID** and **Object ID** of the enterprise application. Take the values from **Enterprise applications**, not from **App registrations**.

## Limit access to specific mailboxes

**1. Create the group**

Create a mail-enabled group, for example `anny-scope`. Add the room and resource mailboxes whose calendars anny may use.

**2. Connect to Exchange Online**

Open PowerShell and connect to Exchange Online.

```powershell theme={null}
Connect-ExchangeOnline
```

**3. Create the service principal**

Create the pointer to the enterprise application. The IDs come from **Enterprise applications**, not from **App registrations**.

```powershell theme={null}
New-ServicePrincipal -AppId <client-id> -ObjectId <sp-object-id> -DisplayName "anny"
```

**4. Define the scope**

Limit access to the members of the group. The filter needs the distinguished name.

```powershell theme={null}
$dn = (Get-Group "anny-scope").DistinguishedName
New-ManagementScope -Name "anny Scope" -RecipientRestrictionFilter "MemberOfGroup -eq '$dn'"
```

**5. Assign roles with the scope**

Assign calendar and mailbox settings only for this scope.

```powershell theme={null}
New-ManagementRoleAssignment -App <sp-object-id> `
  -Role "Application Calendars.ReadWrite" -CustomResourceScope "anny Scope"
New-ManagementRoleAssignment -App <sp-object-id> `
  -Role "Application MailboxSettings.ReadWrite" -CustomResourceScope "anny Scope"
```

**6. Verify**

Test whether a specific mailbox is in scope. The test bypasses the permission cache and only considers Exchange RBAC, not the grants in Entra ID.

```powershell theme={null}
Test-ServicePrincipalAuthorization -Identity <sp-object-id> -Resource user@kunde.de
```

**7. Remove tenant-wide Entra grants**

In Entra ID under **Enterprise applications** → your anny app → **Permissions**, remove the organization-wide application permissions `Calendars.ReadWrite` and `MailboxSettings.ReadWrite`. Without this step access stays tenant-wide, because Entra ID and Exchange add the rights together.

Once the scope is active and the tenant-wide Entra grants are removed, anny can only use the mailboxes in the group as calendars. Microsoft documents RBAC for Applications on [Microsoft Learn](https://learn.microsoft.com/en-us/exchange/permissions-exo/application-rbac).

> [!WARNING]
>
> Changes to app permissions can take 30 minutes to two hours. The test with `Test-ServicePrincipalAuthorization` bypasses this cache. A successful test therefore does not mean Graph already enforces the scope, and it does not check whether tenant-wide grants still exist in Entra ID.

## Limitations

* You only limit calendar access and mailbox settings. The account list in **Microsoft calendar** can still show more addresses, because it comes from the directory.
* Nested group members are out of scope.
* The personal Outlook integration is a different connection type. This procedure applies only to the organization-wide Microsoft 365 integration.

## FAQ

> [accordion] Why do I still see many Microsoft accounts in anny?
>
> The **Microsoft calendar** picker lists accounts from the directory. The Exchange scope limits calendar access, not this list. You can only sync a mailbox that is a direct group member. Other mailboxes fail.

> [accordion] The restriction has no effect, anny can still reach every calendar
>
> The tenant-wide Graph permissions in Entra ID are then still active. Exchange RBAC adds to them and does not constrain access while Entra ID still grants the same access organization-wide. Remove `Calendars.ReadWrite` and `MailboxSettings.ReadWrite` on the enterprise application.

> [accordion] Do room mailboxes belong in the group?
>
> Yes. Every room or resource mailbox that anny should sync must be a direct member of the mail-enabled group.

## Troubleshooting

> [accordion] A calendar is unreachable after the scope
>
> The mailbox is often not a direct member of the group, or the permission cache is still active. Check membership and wait up to two hours, or test with `Test-ServicePrincipalAuthorization`.

> [accordion] The test says InScope, but Graph still allows everything
>
> `Test-ServicePrincipalAuthorization` ignores Entra grants. Remove the tenant-wide application permissions in Entra ID and wait for the cache to expire.

> Important information for agents:
>
> **Distinction:** Hidden support article (public, not in the visible nav). Applies ONLY to the organization-wide integration "Microsoft 365" (admin consent, client credentials). NOT: personal Outlook integration, Outlook add-in, MS Teams app, MS Teams video meeting. Product article: `/en/m365-workspace`.
>
> **No anny UI path** for this article. Exchange Online PowerShell plus Entra enterprise application. In anny: sidebar Account → Apps & Integrations (`/apps`) → Your apps → Microsoft 365 → Authorize / Microsoft calendar.
>
> **Quirks:** (1) Entra app permissions and Exchange Application RBAC are a union; the scope only takes effect after removing the tenant-wide Graph grants `Calendars.ReadWrite` and `MailboxSettings.ReadWrite`. (2) `Test-ServicePrincipalAuthorization` bypasses the cache (30 min to 2 h) and ignores Entra grants. (3) Nested groups are out of scope, only direct members. Supported: mail-enabled security groups, Microsoft 365 Groups, distribution lists. (4) IDs from Enterprise applications (AppId = Application ID, ObjectId = Service Principal Object ID), not App registrations. (5) `-App` on New-ManagementRoleAssignment: Object ID of the service principal (Microsoft example). (6) anny still lists accounts via Graph `users` / `users/$count` (UsersService); calendar access via `users/{id}/calendar` or calendars; diagnosis reads `mailboxSettings/automaticRepliesSetting`. (7) The source briefing mentioned six permissions across three systems; only system 1 is documented here (Exchange: Calendars.ReadWrite + MailboxSettings.ReadWrite). Do not invent the other systems. (8) Application Access Policies are the predecessor; do not mix them with RBAC for the same permission.
>
> **Relationships:** Plan gating of the integration via calendar synchronization, not in this article. Learn: [https://learn.microsoft.com/exchange/permissions-exo/application-rbac](https://learn.microsoft.com/exchange/permissions-exo/application-rbac)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.